TwentyOne

Summary

The startGame function lacks an access control, allowing any users to call the function without restrictions. This opens the contract to misuse, including spam attacks, unauthorized participation, and potential denial-of-service (DOS) attacks.

Vulnerability Details

Unrestricted Access: The function allows any address to call startGame as long as the caller sends at least 1 ETH. There are no eligibility checks or restrictions in place.

No Limit on Call Frequency: There are no measures to prevent spam or excessive repeated calls, leading to potential abuse by malicious actors.
Players can start multiple games without completing previous ones, as there is no mechanism to track or restrict concurrent game sessions for the same player.

Impact

Malicious users can repeatedly call the function, bloating storage or using up gas resources unnecessarily.

Tools Used

Manual review

Recommendations

Implement role-based access control for managing players or game rules using libraries like OpenZeppelin's AccessControl.