TwentyOne

Summary

The game relies on the player to explicitly call either the hit() or call() functions to progress the game and conclude it. If a user fails to make these calls, either intentionally or due to negligence, the game will remain in an incomplete state.

Vulnerability Details

A game starts with startGame(), initializing the player's and dealer's decks.

The game continues only when the player calls hit() to draw another card or call() to conclude their hand.

If the user does not call these functions, the game will not end, and resources associated with the player (e.g., cards and storage mappings) will remain allocated indefinitely.

Impact

Players involved in unfinished games cannot start new games until the previous one concludes. This can cause confusion if users are unaware of this dependency.

Tools Used

manual

Recommendations

Implement a timeout mechanism to automatically conclude games that remain inactive for a specified duration.