TwentyOne
First Flight #29
Beginner FriendlyGameFiFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

No Balance Check Before Sending Prize in `endGame` Function

lydiamt

Summary

The endGame function does not check the contract's balance before transferring the prize to the player. This could lead to a failed transaction if the contract does not have enough funds to cover the payout.

Vulnerability Details

In the current implementation of the endGame function, the contract attempts to transfer 2 ETH to the player when they win without verifying that the contract has sufficient balance. If the contract's balance is less than 2 ETH, the transaction will fail, and the player will not receive their prize.

function endGame(address player, bool playerWon) internal {
delete playersDeck[player].playersCards; // Clear the player's cards
delete dealersDeck[player].dealersCards; // Clear the dealer's cards
delete availableCards[player]; // Reset the deck
if (playerWon) {
payable(player).transfer(2 ether); // Transfer the prize to the player
emit FeeWithdrawn(player, 2 ether); // Emit the prize withdrawal event
}
}

Impact

Without a balance check, the contract may attempt to transfer more ether than it holds, resulting in failed transactions.

Tools Used

Manual Review.

Recommended Mitigation

Before attempting to transfer the prize, the contract should check if it has enough balance to fulfill the payout. If the balance is insufficient, it should revert the transaction to prevent any failed transfers.

function endGame(address player, bool playerWon) internal {
delete playersDeck[player].playersCards; // Clear the player's cards
delete dealersDeck[player].dealersCards; // Clear the dealer's cards
delete availableCards[player]; // Reset the deck
if (playerWon) {
uint256 contractBalance = address(this).balance;
require(contractBalance >= 2 ether, "Insufficient contract balance");
payable(player).transfer(2 ether); // Transfer the prize to the player
emit FeeWithdrawn(player, 2 ether); // Emit the prize withdrawal event
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Insufficient balance for payouts / Lack of Contract Balance Check Before Starting Game

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.