TwentyOne

First Flight #29
Beginner FriendlyGameFiFoundrySolidity
100 EXP
View results
Submission Details
Severity: low
Invalid

In the function `TwentyOne:startGame`,if the user deposit more than 1 ehter, these ether will be locked in the contract forever

Description: the function `TwentyOne:startGame, requires that the user sends at least 1 ether to start the game, but the function just checks if the user send more than 1 ether but there is not a function to withdraw or get back these extra ether that you sent.

function startGame() public payable returns (uint256)
.
@> require(msg.value >= 1 ether, "not enough ether sent");
.
.
.
.
.

Impact: if the user sends more than 1 ether, these ether Will be lost, because there isn't a function to withdraw these extra ether.

Proof of Concept:

  1. A user sends 2 ether.

  2. The user play

  3. the user Won't get back the extra ether.

Recommended Mitigation:

check that the user sent exactly 1 ether

````diff

+require(msg.value >= 1 ether, "not enough ether sent");

-require(msg.value == 1 ether, "not enough ether sent");

```

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[INVALID] User mistake, too much ETH sent

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.