TwentyOne

Summary

The contract has no ETH from beginning and no receive() or fallback() functions, so it can't receive ETH. Therefore the first winner couldn't receive 2 ETH prize due to lack of ETH.

Vulnerability Details

The contract cannot receive Ether directly, such as via a plain transfer (send, transfer, or low-level call) to its address. Ether sent directly to the contract (e.g., by mistake or intentional funding) will revert, limiting the flexibility of funding the contract.

When the endGame() function attempts to transfer 2 ether to the player if they win, but the contract has enough balance, so it will fail.

Impact

project insolviency

Tools Used

manual review

Recommendations

Add ether accumlation mechanism.

• add receive()/fallback()

• add a callable function that explicitly allows users or the owner to deposit Ether into the contract.