TwentyOne

Summary

In a standard Blackjack game, the Ace card can be either 1 or 11 depending on the current hand total. However, in both the playersHand and dealersHand functions of the contract, Aces are always treated as 10, leading to incorrect hand totals and causing issues with the game's logic.

Vulnerability Details

The playersHand function does not account for Aces as 1 or 11, and always treats them as 10. This can cause incorrect hand totals. Similarly, the dealersHand function always counts Aces as 10, which is also incorrect for dealer calculations. The code for both functions needs to be updated to properly account for Aces being counted as either 1 or 11, depending on the situation. Here are the functions:

Impact

If Aces are not handled correctly, both the player's and dealer's hands could have incorrect values, which would cause the game to have faulty logic. The game would fail to properly evaluate hand totals, leading to situations where the player or dealer could unfairly win or lose due to incorrect scoring.

Tools Used

Manual review

Recommendations

Both the playersHand and dealersHand functions should be updated to handle Aces as either 1 or 11. This is necessary for accurate hand totals and to ensure the game follows the correct Blackjack rules. If adding an Ace as 11 does not cause the hand total to exceed 21, it should be counted as 11. If adding an Ace as 11 would cause a bust (hand total > 21), it should be counted as 1.