TwentyOne
First Flight #29
Beginner FriendlyGameFiFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

User funds can be locked forever because there is no check that contract can pay user at starts

foufrix

Summary

A user can start a game even though there are not enough funds on the contract to pay him back if he wins.

Vulnerability Details

startGame() do not check if there is enough ETH at the start to pay back the user in case he wins.
If a user wins, endGame() It will revert as it will try to send 2 ether, but there are insufficient funds on the contract.
There is no way for the user to retrieve his funds.

Impact

A user can lock all of his 1 ETH on the contract.

Tools Used

Manual

Recommendations

Check that the contract holds enough funds to pay the user back in case he wins when creating a game.

require(address(this).balance >= 1 ether)

We can go further and require the contract to check if other players are already playing and that the balance is superior to the total of players playing.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Insufficient balance for payouts / Lack of Contract Balance Check Before Starting Game

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.