TwentyOne
First Flight #29
Beginner FriendlyGameFiFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Payment Verification and Tracking in startGame Function

hawks

Summary

The startGame function lacks a verification mechanism to ensure players have paid before starting the game. Additionally, there is no record-keeping of who paid or the amount paid, leading to potential exploitation and lack of transparency.

Vulnerability Details

function startGame() public payable returns (uint256) {
address player = msg.sender;
require(msg.value >= 1 ether, "not enough ether sent");
initializeDeck(player);
uint256 card1 = drawCard(player);
uint256 card2 = drawCard(player);
addCardForPlayer(player, card1);
addCardForPlayer(player, card2);
return playersHand(player);
}

Impact

  • Unauthorized Game Access:
    Players can start the game without paying since the function does not verify payment before allowing participation.

  • Free Prize Claims:
    Players can exploit the system to claim prizes without making the required deposit.

  • Lack of Payment Records:
    There is no mechanism to track which address paid and the amount, leading to potential disputes and lack of transparency.

Tools Used

Manual Review

Recommendations

  • Add a mapping that keeps a record of each address and the amount players have paid.

  • Add a new mapping to check if a player has paid. To implement this condition, the onlyOwner modifier must be added so that only the owner can check if a player has paid.

​
mapping(address => uint256) public playerPayments;
​
mapping(address => bool) public isAuthorizedPlayer;
​
address public owner;
​
constructor() {
owner = msg.sender;
}
​
modifier onlyOwner() {
require(msg.sender == owner, "TwentyOne: Not the contract owner");
_;
}
​
​
function startGame() public payable returns (uint256) onlyOwner {
address player = msg.sender;
//check if player paid
require(isAuthorizedPlayer[player], "TwentyOne: Player did not pay");
require(msg.value >= 1 ether, "not enough ether sent");
// Update player amount
playerPayments[player] += msg.value;
initializeDeck(player);
uint256 card1 = drawCard(player);
uint256 card2 = drawCard(player);
addCardForPlayer(player, card1);
addCardForPlayer(player, card2);
return playersHand(player);
}

With these changes:

  1. Only the owner can verify if a player has paid to start the game.

  2. Player payments are recorded by address and amount for transparency

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.