Description: the function `TwentyOne:startGame, requires that the user sends at least 1 ether to start the game, but the function just checks if the user send more than 1 ether but there is not a function to withdraw or get back these extra ether that you sent.
Impact: if the user sends more than 1 ether, these ether Will be lost, because there isn't a function to withdraw these extra ether.
Proof of Concept:
A user sends 2 ether.
The user play
the user Won't get back the extra ether.
Recommended Mitigation:
check that the user sent exactly 1 ether
````diff
+require(msg.value >= 1 ether, "not enough ether sent");
-require(msg.value == 1 ether, "not enough ether sent");
```
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.