TwentyOne
First Flight #29
Beginner FriendlyGameFiFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Allowing Stakes of More Than 1 Ether Can Cause Players to Lose Funds

icon0x

Summary

Vulnerability Details

In the TwentyOne::startGame function, players can stake more than 1 ether. However, regardless of the amount staked (e.g., 3, 4, or 5 ether), the contract always pays out exactly 2 ether as the winning prize. This means that players who stake more than 1 ether will lose the extra funds they contribute.

Here is the relevant code that allows players to stake more than 1 ether:

function startGame() public payable returns (uint256) {
address player = msg.sender;
@> require(msg.value >= 1 ether, "not enough ether sent");
initializeDeck(player);
uint256 card1 = drawCard(player);
uint256 card2 = drawCard(player);
addCardForPlayer(player, card1);
addCardForPlayer(player, card2);
return playersHand(player);
}
​

Impact

Players who stake more than 1 ether will lose the extra funds, as the contract only considers 1 ether when calculating the winning prize. (double 1 ether == 2 ether)

Tools Used

Manual Review

##Proof of Concept
The following scenario shows how a player can lose ether:

  • Initial Contract Balance: 10 ether

  • A player initiates TwentyOne::startGame with 3 ether instead of 1 ether

  • Contract Balance: 13 ether

  • If the player wins, they will receive only 2 ether (the winning prize), causing them to lose 1 ether to the contract.

Recommendations

To fix this issue, modify the contract to restrict players to stake exactly 1 ether:

function startGame() public payable returns (uint256) {
address player = msg.sender;
- require(msg.value >= 1 ether, "not enough ether sent");
+ require(msg.value == 1 ether, "not enough ether sent");
initializeDeck(player);
uint256 card1 = drawCard(player);
uint256 card2 = drawCard(player);
addCardForPlayer(player, card1);
addCardForPlayer(player, card2);
return playersHand(player);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[INVALID] User mistake, too much ETH sent

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.