TwentyOne
First Flight #29
Beginner FriendlyGameFiFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Insufficient Contract Balance May Prevent Winner Payout in endGame

parmakhanm786

Summary

The endGame function includes a mechanism to transfer 2 Ether to the winning player. However, there is no check to ensure that the contract holds sufficient Ether to fulfill this payout. If the contract's balance is less than 2 Ether, the transfer will fail, causing the function to revert. This could disrupt the game flow and lead to user dissatisfaction or mistrust

Impact

The inability to pay winners undermines trust in the game, negatively affecting its reputation and user adoption.

Tools Used

Manual

Recommendations

There shoudl be a check always in contract that there are enough ether to pay back to the winner

POC

Step 1 : user first trigger start the game with 1 eth

function startGame() public payable returns (uint256) {
address player = msg.sender;
require(msg.value >= 1 ether, "not enough ether sent");
initializeDeck(player);
uint256 card1 = drawCard(player);
uint256 card2 = drawCard(player);
addCardForPlayer(player, card1);
addCardForPlayer(player, card2);
return playersHand(player);
}
​

Step 2 : balance of contract = 1 ETH

Step 3 : user call hit and his card count becomes 21

function hit() public {
require(
playersDeck[msg.sender].playersCards.length > 0,
"Game not started"
);
uint256 handBefore = playersHand(msg.sender);
require(handBefore <= 21, "User is bust"); // ? Why
uint256 newCard = drawCard(msg.sender);
addCardForPlayer(msg.sender, newCard);
uint256 handAfter = playersHand(msg.sender);
if (handAfter > 21) {
emit PlayerLostTheGame("Player is bust", handAfter);
endGame(msg.sender, false);
}
}

Step 4 : contract balance is 1 ETH so contract unable to pay the amount

function endGame(address player, bool playerWon) internal {
delete playersDeck[player].playersCards; // Clear the player's cards
delete dealersDeck[player].dealersCards; // Clear the dealer's cards
delete availableCards[player]; // Reset the deck
if (playerWon) {
payable(player).transfer(2 ether); // Transfer the prize to the player
emit FeeWithdrawn(player, 2 ether); // Emit the prize withdrawal event
}
}

there must be check for 2 ETH

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Insufficient balance for payouts / Lack of Contract Balance Check Before Starting Game

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.