TwentyOne
First Flight #29
Beginner FriendlyGameFiFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

The number of cards in a player's hand is visible to everyone.

hyer

Summary

Using the public modifier on the playersHand function allows anyone to freely view a player's hand total, which creates a risk of cheating. This transparency could be exploited by other players or malicious actors to gain an unfair advantage, as they can monitor the player's current hand value (i.e., the total of their cards) at any point in the game.

Vulnerability Details

https://github.com/Cyfrin/2024-11-TwentyOne/blob/a4429168302722d14a5e5996d25d6fc5be22a899/src/TwentyOne.sol#L29

Using the public modifier allows players to pass in other players' addresses and view their hand card counts, which creates a cheating mechanism.

Impact

The game becomes unfair.

Tools Used

Manual review

Recommendations

The caller must be the same as the provided player address.

function playersHand(address player) public view returns (uint256) {
// Ensure the caller is the same as the player
require(msg.sender == player, "You can only check your own hand"); // Ensure the caller is the same as the player
uint256 playerTotal = 0;
//...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.