TwentyOne

Summary

In the call() function of the TwentyOne contract, draw scenarios (when the player's hand equals the dealer's hand) are treated as a loss for the player. This behavior violates standard blackjack rules, where a draw results in a "push," meaning the player's bet should be returned without any winnings or losses. This issue causes unfair losses for players and undermines trust in the platform.

Vulnerability Details

The call() function lacks explicit logic for handling draw scenarios. When the player's hand equals the dealer's hand, the contract defaults to the final else statement, which treats the draw as a loss:

This implementation results in the player's deposit being forfeited even though neither side won the game.

Example Scenario

Initial Setup:

• The player's hand total is 20.

• The dealer's hand total is also 20.

Execution:

• The player calls the call() function.

• The else clause is executed, treating the draw as a loss.

Outcome:

• The player loses their 1 ETH bet, which should have been refunded in a draw scenario.

Impact

• Unfair Gameplay: Players lose their bet even when they tie with the dealer, leading to dissatisfaction.

• Negative User Experience: Players may feel cheated, reducing trust in the platform.

• Violation of Blackjack Rules: Standard rules dictate that a draw (push) should result in no net loss or gain for the player.

Tools Used

Manual Review

Recommendations

Add Draw Logic to call() Function:
Update the function to handle draw scenarios explicitly. If the player's hand equals the dealer's hand, emit a specific event and refund the player's bet.

Updated call() Function:

• Update endGame Function:
  Modify endGame to handle draws and refund the player's bet if the game ends in a draw.

  Updated endGame Function:

  function endGame(address player, bool playerWon, bool isDraw) internal {

  delete playersDeck[player].playersCards; // Clear the player's cards

  delete dealersDeck[player].dealersCards; // Clear the dealer's cards

  delete availableCards[player]; // Reset the deck

  ​

  if (playerWon) {

  payable(player).transfer(2 ether); // Transfer the prize to the player

  emit FeeWithdrawn(player, 2 ether);

  } else if (isDraw) {

  payable(player).transfer(1 ether); // Refund the player's bet

  emit FeeWithdrawn(player, 1 ether);

  }

  }

  ​