Submission Details
Severity:
Lack of access control in TwentyOne.sol : : getPlayerCards()
Summary
The getPlayerCard function lacks access control, allowing any address to unauthorized card viewing and accessing another player's game details
Vulnerability Details
function getPlayerCards (address player) public view returns (uint256[] memory) { //No Access Control
return playersDeck[player].playersCards;
}
Impact
Privacy violation and potential game exploitation
Tools Used
Manual code review
Foundry testing framework
Custom access control test
Recommendations
Add access modifiers
Implement role-based access control
Use require() statements to check sender permissions
Rewards breakdown
nSLOC
147This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.