Submission Details
Severity:
TwentyOne::playersHand & TwentyOne::dealersHand functions doesn't check if the game is started
Summary
TwentyOne::playersHand & TwentyOne::dealersHand functons lack the check for if the game is started or not..!!
Vulnerability Details
```javascript
function playersHand(address player) public view returns (uint256) {
//-->> no check for if the game has started or not..!!
uint256 playerTotal = 0;
for (uint256 i = 0; i < playersDeck[player].playersCards.length; i++) {
uint256 cardValue = playersDeck[player].playersCards[i] % 13;
if (cardValue == 0 || cardValue >= 10) {
playerTotal += 10;
} else {
playerTotal += cardValue;
}
}
return playerTotal;
}
function dealersHand(address player) public view returns (uint256) {
//-->> no check for if the game has started or not..!!
uint256 dealerTotal = 0;
for (uint256 i = 0; i < dealersDeck[player].dealersCards.length; i++) {
uint256 cardValue = dealersDeck[player].dealersCards[i] % 13;
if (cardValue >= 10) {
dealerTotal += 10;
} else {
dealerTotal += cardValue;
}
}
return dealerTotal;
}
```
Impact
Can be wasteful in terms of gas if they are called before the TwentyOne::startGame function
PoC
Run this test in your test file
PoC
function testHandFunctionsWasteGas() public {
vm.startPrank(player1);
uint256 startGas = gasleft();
console.log("start:",startGas);
twentyOne.playersHand(player1);
uint256 gasUsed = startGas - gasleft();
console.log("Gas used: ", gasUsed);
}
Tools Used
Manual Review
Recommendations
Add checks in both the functions if the game has started or not..!!
function playersHand(address player) public view returns (uint256) {
+ require(playersDeck[player].playersCards.length > 0, "Game not started");
uint256 playerTotal = 0;
for (uint256 i = 0; i < playersDeck[player].playersCards.length; i++) {
uint256 cardValue = playersDeck[player].playersCards[i] % 13;
if (cardValue == 0 || cardValue >= 10) {
playerTotal += 10;
} else {
playerTotal += cardValue;
}
}
return playerTotal;
}
function dealersHand(address player) public view returns (uint256) {
+ require(dealersDeck[player].dealersCards.length > 0, "Game not started");
uint256 dealerTotal = 0;
for (uint256 i = 0; i < dealersDeck[player].dealersCards.length; i++) {
uint256 cardValue = dealersDeck[player].dealersCards[i] % 13;
if (cardValue >= 10) {
dealerTotal += 10;
} else {
dealerTotal += cardValue;
}
}
return dealerTotal;
}
Rewards breakdown
nSLOC
147This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.