TwentyOne

Summary

Because this contract does not have a representation of the game state, functions in the contract can be called freely whether the game has ended or has not started.

Vulnerability Details

• For example, these two functions

  https://github.com/Cyfrin/2024-11-TwentyOne/blob/a4429168302722d14a5e5996d25d6fc5be22a899/src/TwentyOne.sol#L175-L186

  You can view the players' and the dealer's hands at any time

• For example, in this function.

  https://github.com/Cyfrin/2024-11-TwentyOne/blob/a4429168302722d14a5e5996d25d6fc5be22a899/src/TwentyOne.sol#L104-L119

  If this function is called before the game starts to add cards to the player's hand, it would allow the player to add cards multiple times.

Impact

Functions in the contract can be called whether the game has started or already ended, which would lead to players being unable to determine the game progress.

Tools Used

manual inspection

Recommendations

Add an enum type to track the game state.