Submission Details
Severity:
The `TwentyOne::endGame` function uses `transfer()` instead of `call()`
Description
The function TwentyOne::endGame in charge of sending the ETH to the winners uses transfer() instead of call().
Impact
Depending on the winner player, the use of transfer might render ETH impossible to withdraw due to the 2300 forwarded gas limitation.
Recommended mitigation
function endGame(address player, bool playerWon) internal {
delete playersDeck[player].playersCards; // Clear the player's cards
delete dealersDeck[player].dealersCards; // Clear the dealer's cards
delete availableCards[player]; // Reset the deck
if (playerWon) {
- payable(player).transfer(2 ether); // Transfer the prize to the player
+ (bool sent,) = payable(player).call{value: 2 ether}("");
+ require(sent, "Sent failed");
emit FeeWithdrawn(player, 2 ether); // Emit the prize withdrawal event
}
}
Rewards breakdown
nSLOC
147This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.