Submission Details
Severity:
The game contract may not have enough ether to pay out the ether if players win the game.
Description: If the game contract does not have enough ether, player can still start the game, if the player win the game, the pay out will fail.
function endGame(address player, bool playerWon) internal {
delete playersDeck[player].playersCards; // Clear the player's cards
delete dealersDeck[player].dealersCards; // Clear the dealer's cards
delete availableCards[player]; // Reset the deck
if (playerWon) {
@> payable(player).transfer(2 ether); // Transfer the prize to the player
emit FeeWithdrawn(player, 2 ether); // Emit the prize withdrawal event
}
}
Impact:
The can break the game pay out logic, player can win the game but the pay out will fail.
Proof of Concept:
create a fresh game contract.
PLAYER deposits 1 ether and win the game.
Add the following code into TwentyOne.t.sol:
Proof of Code
```solidity function test_PlayerWins_but_game_has_insufficient_eth() public { vm.startPrank(player1); twentyOne.startGame{value: 1 ether}();
vm.expectRevert();
twentyOne.call();
vm.stopPrank();
}
```
Recommended Mitigation:
Add a lockedPayoutEther to keep track of the ether that is locked for payout, and check if the contract has enough balance to pay out the ether.
function startGame() public payable returns (uint256) {
address player = msg.sender;
require(msg.value == BET, "only 1 ether allowed");
// fix for payout
+ require(address(this).balance - lockedPayoutEther >= PAYOUT, "not enough balance to pay out");
+ lockedPayoutEther += PAYOUT;
...
}
...
function endGame(address player, bool playerWon) internal {
delete playersDeck[player].playersCards; // Clear the player's cards
delete dealersDeck[player].dealersCards; // Clear the dealer's cards
delete availableCards[player]; // Reset the deck
+ lockedPayoutEther -= PAYOUT;
if (playerWon) {
payable(player).transfer(PAYOUT); // Transfer the prize to the player
emit FeeWithdrawn(player, PAYOUT); // Emit the prize withdrawal event
}
}
Updates
Lead Judging Commences
inallhonesty 11 months ago
Submission Judgement Published Assigned finding tags:
Insufficient balance for payouts / Lack of Contract Balance Check Before Starting Game
Rewards breakdown
nSLOC
147This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.