Submission Details
Severity:
Lack of Access Control Allows Unauthorized Viewing of Cards
Summary
The getPlayerCards and getDealerCards functions lack access control, allowing any user to call these functions and retrieve the cards of any player or dealer by specifying their address. This violates the principle of data confidentiality, as players should only be able to view their own cards and dealers should only access their own cards.
Impact
Unauthorized users can view sensitive game information, such as the cards held by other players and dealers.
Tools Used
Manual
Recommendations
function getPlayerCards(
address player
) public view returns (uint256[] memory) {
+ require(msg.sender == player);
return playersDeck[player].playersCards;
}
function getDealerCards(
address player
) public view returns (uint256[] memory) {
+ require(msg.sender == player);
return dealersDeck[player].dealersCards;
}
Rewards breakdown
nSLOC
147This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.