TwentyOne

Summary

The hit() function in the smart contract does not properly handle the case where a player's hand reaches exactly 21 points. The function also allows players to draw a card when their hand is exactly 21, which should not be allowed, as 21 is the winning condition in Blackjack. Additionally, the function does not handle the scenario where a player wins by hitting exactly 21.

Vulnerability Details

The function has two issues:

1. Players can hit after reaching 21: The require(handBefore <= 21, "User is bust") condition in the hit() function allows the player to hit when their hand is exactly 21. The condition should be modified to only allow players to hit if their hand is less than 21.

2. The player does not win with a hand of 21: After drawing a card, the function checks if the player's hand exceeds 21 (if (handAfter > 21)). However, it does not handle the case where the player's hand is exactly 21. In this case, the player should immediately win the game. The current logic only handles busting (over 21) and does not reward the player for achieving exactly 21.

Impact

The current implementation prevents players from winning when their hand reaches exactly 21. Additionally, the function incorrectly allows players to hit if they have already reached a hand value of 21, which is against the rules of Blackjack. This could lead to inconsistent gameplay behavior, as the player is unable to win or finish the game properly once their hand reaches 21.

Tools Used

• Manual Code Review

Recommendations

1. Modify the require statement to ensure that the player can only hit if their hand value is strictly less than 21. Update the code as follows:

   require(handBefore < 21, "User is bust");

   ​

2. Add a condition to check whether the player's hand equals 21 after drawing a card, and handle it as a win. Update the relevant section of the code as follows:

   if (handAfter == 21) {

   emit PlayerWonTheGame("Player wins with 21", handAfter);

   endGame(msg.sender, true);

   } else if (handAfter > 21) {

   emit PlayerLostTheGame("Player is bust", handAfter);

   endGame(msg.sender, false);

   }

   ​

Implementing these changes will align the game's behavior with Blackjack rules. Specifically, it will prevent players from drawing additional cards when their hand is exactly 21 and will correctly recognize and reward a player who achieves a hand value of 21.