Submission Details
Severity:
Anyone can view the dealer's hand count.
Summary
There are no restrictions on dealersHand, allowing anyone to view the dealer's hand.
Vulnerability Details
he function is marked as public, which allows anyone to freely view the dealer's hand count. This enables players to compare their hand's value with the dealer's in advance, giving them the opportunity to gain an unfair advantage.
Impact
The game becomes unfair.
Tools Used
Manual review
Recommendations
"Check if the caller is the dealer
function dealersHand(address player) public view returns (uint256) {
uint256 dealerTotal = 0;
// Assuming the dealer's address is the one calling the function
address dealer = msg.sender;
// Ensure the caller is the dealer
require(dealer == player, "Only the dealer can check the dealer's hand");
//...
}
Rewards breakdown
nSLOC
147This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.