TwentyOne
First Flight #29
Beginner FriendlyGameFiFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Contract funds exhaustion prevents single-player gameplay.

oxenzo

Description:

The contract's design allows players to win Ether rewards based on the outcome of their game. However, this reward system is dependent on the contract's available balance. If a single player continuously plays the game and wins repeatedly, the contract may run out of funds. In such a scenario, the game would no longer be playable, as rewards cannot be issued to the player, effectively halting the game's functionality. This issue stems from the lack of a mechanism to replenish the contract's funds dynamically or to cap payouts when funds are low.

Impact:

Once the contract balance is exhausted, it can no longer issue rewards, leading to a denial of service for the player.

Proof of Concept:

Place this in the TwentyOne.t.sol test suite.

​
function test_onePlayerCanplayGameandContractHasinsufficientfunds() public {
vm.startPrank(player1); // Start acting as player
​
// Start the game with 1 ether bet
twentyOne.startGame{value: 1 ether}();
twentyOne.call();
vm.stopPrank();
}
​

The following logs would be outputted::

[1446151] TwentyOneTest::test_onePlayerCanplayGameandContractHasinsufficientfunds()
├─ [0] VM::startPrank(0x0000000000000000000000000000000000000123)
│ └─ ← [Return]
├─ [1270369] TwentyOne::startGame{value: 1000000000000000000}()
│ └─ ← [Return] 14
├─ [155590] TwentyOne::call()
│ ├─ emit PlayerWonTheGame(message: "Dealer went bust, players winning hand: ", cardsTotal: 14)
│ ├─ [0] 0x0000000000000000000000000000000000000123::fallback{value: 2000000000000000000}()
│ │ └─ ← [OutOfFunds] EvmError: OutOfFunds
│ └─ ← [Revert] EvmError: Revert
└─ ← [Revert] EvmError: Revert
​

Proving that the contract may run out of funds.

Tools Used:

Manual Review and foundry.

Recommended Mitigation:

Introduce a house edge or a small fee for each game played to sustain the contract balance over time.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Insufficient balance for payouts / Lack of Contract Balance Check Before Starting Game

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.