Submission Details
Severity:
Unfair cards value check for inexperienced players in `hit` function.
Summary
The current system for checking cards values in hit function presents an unfair advantage for casino at the expense of players who are new to the game mechanics.
Vulnerability Details
The hit function allows players to receive additional cards even if their current hand value is equal to 21.
uint256 handBefore = playersHand(msg.sender);
- require(handBefore <= 21, "User is bust");
Impact
By permitting hits after reaching 21, players face a guaranteed loss, as exceeding 21 results in an automatic win for the house .
Tools Used
Manual code review.
Recommendations
Apply this code:
uint256 handBefore = playersHand(msg.sender);
+ require(handBefore < 21, "User is bust");
Rewards breakdown
nSLOC
147This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.