TwentyOne

Summary

The game summary states that users deposit 1 ETH for a chance to double their money and win 2ETH.

The contract only requires 1 ETH to play with no initial deposit from the deployer for a potential prize for the first player.

this can rug the first player unless they deposit >= 2ETH in which they would not double their money but only get their initial deposit back (or lose if they deposit > 2 ETH).

it would also make subsequent players after a successful win w/ a payout of 2ETH become victims to the same bug once the balance is reset to 0 if they only deposit the required 1 ETH.

Vulnerability Details

Line #170

the contract attempts to transfer 2 ETH while potentially only holding 1 ETH and will revert if a player only deposited the minimal required 1ETH.

Impact

First player may lose deposit even if they win the game as well as players after the first successful win with a 2ETH payout when the balance is reset to 0.

Tools Used

manual analysis. forge test

Recommendations

add a constructor to the contract for the game deployer to fund the contract with the initial ETH winnings for the player to potentially win.

remove the 2 ETH limit on Line #170 and replace it with address(this).balance so the winner simply gets their initial deposit back and creates a winner take all scenario.

this protects the first player and subsequnet players after the first win where the contract balance is reset.