Submission Details
Severity:
Player and dealer are the same address in call function
Summary
In TwentyOne::call function, both the player and the dealer are called via msg.sender, which goes against the very idea of having two different entities.
Vulnerability Details
The docs state:
Dealer: The virtual counterpart managed by the smart contract. The dealer draws cards based on game logic.
In TwentyOne::call function, both the player and the dealer are called via msg.sender. Both the while loop and the subsequent uint256 dealerHand = dealersHand(msg.sender);will work on the callers, i.e. the player's address, breaking the function and the contract.
function call() public {
require(playersDeck[msg.sender].playersCards.length > 0, "Game not started");
uint256 playerHand = playersHand(msg.sender);
// Calculate the dealer's threshold for stopping (between 17 and 21)
uint256 standThreshold =
(uint256(keccak256(abi.encodePacked(block.timestamp, msg.sender, block.prevrandao))) % 5) + 17;
// Dealer draws cards until their hand reaches or exceeds the threshold
while (dealersHand(msg.sender) < standThreshold) {
uint256 newCard = drawCard(msg.sender);
addCardForDealer(msg.sender, newCard);
}
uint256 dealerHand = dealersHand(msg.sender);
// Determine the winner
if (dealerHand > 21) {
emit PlayerWonTheGame("Dealer went bust, players winning hand: ", playerHand);
endGame(msg.sender, true);
} else if (playerHand > dealerHand) {
emit PlayerWonTheGame("Dealer's hand is lower, players winning hand: ", playerHand);
endGame(msg.sender, true);
} else {
emit PlayerLostTheGame("Dealer's hand is higher, dealers winning hand: ", dealerHand);
endGame(msg.sender, false);
}
}
Impact
The game is unplayable.
Tools Used
Manual review
Recommendations
Rewards breakdown
nSLOC
147This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.