Submission Details
Severity:
Aces are always counted as 1 (missing the optional 11 value)
Summary
TwentyOne::playersHand function disregards that Aces can be counted as 1 or 11.
Vulnerability Details
According to blackjack rules, aces count 1 or 11 according to the player's coice. playersHand function below does not handle the dual value of Ace that can be either 1 or 11.
function playersHand(address player) public view returns (uint256) {
uint256 playerTotal = 0;
for (uint256 i = 0; i < playersDeck[player].playersCards.length; i++) {
uint256 cardValue = playersDeck[player].playersCards[i] % 13;
if (cardValue == 0 || cardValue >= 10) {
playerTotal += 10;
} else {
playerTotal += cardValue;
}
}
return playerTotal; //note invariant: returns player card value
}
This means:
Aces are always counted as 1 (missing the optional 11 value)
There's no proper handling of the Ace's dual value which is a crucial part of Blackjack strategy
Impact
Game logic is broken
Tools Used
Manual review
Recommendations
Rewards breakdown
nSLOC
147This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.