TwentyOne
First Flight #29
Beginner FriendlyGameFiFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Contract Lacks a receive() Function to Set the Base Fund, Potentially Preventing Player Payouts Upon Winning.

howiecht

Summary

TwentyOnecontract does not have an initial fund and has no way to receive ethers, which might result in a player winning the game but being unable to collect their winnings.

Vulnerability Details

TwentyOnehas no ethers when it deploys initially. Whether the first player wins the game or later players win all of the contract's ethers, players will be unable to receive their winnings.

function setUp() public {
twentyOne = new TwentyOne();
+ vm.deal(address(twentyOne), 10 ether);
vm.deal(player1, 10 ether); // Fund player1 with 10 ether
vm.deal(player2, 10 ether); // Fund player2 with 10 ether
}

Add some ethers to the contract at the beginning, and then test_Call_PlayerWins test will pass.

Impact

Players who win the game will be unable to receive their money.

Tools Used

Foundry Test

Recommendations

Add receive() to TwentyOne contract to establish an initial fund.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Contract Lacks Mechanism to Initialize or Deposit Ether

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.