The game summary states that users deposit 1 ETH for a chance to double their money and win 2ETH.
The contract only requires 1 ETH to play with no initial deposit from the deployer for a potential prize for the first player.
this can rug the first player unless they deposit >= 2ETH in which they would not double their money but only get their initial deposit back (or lose if they deposit > 2 ETH).
it would also make subsequent players after a successful win w/ a payout of 2ETH become victims to the same bug once the balance is reset to 0 if they only deposit the required 1 ETH.
the contract attempts to transfer 2 ETH while potentially only holding 1 ETH and will revert if a player only deposited the minimal required 1ETH.
First player may lose deposit even if they win the game as well as players after the first successful win with a 2ETH payout when the balance is reset to 0.
manual analysis. forge test
add a constructor to the contract for the game deployer to fund the contract with the initial ETH winnings for the player to potentially win.
remove the 2 ETH limit on Line #170 and replace it with address(this).balance
so the winner simply gets their initial deposit back and creates a winner take all scenario.
this protects the first player and subsequnet players after the first win where the contract balance is reset.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.