TwentyOne

Summary

There is no upper limit or control on the amount of ETH that can be sent in the startGame() function. A player can send any amount of ETH, as long as it is 1 ETH or more. However, if the player wins, they will only receive a fixed prize of 2 ETH, instead of a payout based on a 1:2 ratio relative to their stake.

Vulnerability Details

In the startGame() function, this line checks if the ETH amount sent is 1ETH or more.

Let's have a scenario whereby player accidentally sends 10 ETH.

1. In the event the player loses

   1. there is no existing function that refunds the additional ETH sent. Player loses 10 ETH to the contract

2. In the event the player wins

   1. the player instead loses 8 ETH, as the game winning is hardcoded in the endGame() function to transfer only 2 ETH to the player as seen below

There is also no withdraw function, other than within endGame(), which is capped to transfer 2ETH per win. The player's funds will then be locked in the contract, with no possibility of intervention by the owner of the TwentyOne contract.

Impact

Player's funds are locked in the contract without any maximum amount - risk of large amounts of ETH being accidentally locked can happen easily.

Tools Used

Manual Review

Recommendations

1. Consider only allowing 1 ETH to be sent at startGame()

2. Include logic or function to handle a 1:2 ratio relative to how much player has sent

3. Create a withdraw function only callable by the TwentyOne contract owner