Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

No player can ever join RockPaperScissors.sol

jeetpal2007

Summary

The smart contract includes functionality to create games using ETH bets via the createGameWithEth() function. However, there is no corresponding joinGameWithEth() function. Instead, thejoinGameWithToken()function explicitly rejects ETH-based games through this condition:

require(game.bet == 0, "This game requires ETH bet");
​

As a result, any game created with an ETH bet (i.e., game.bet > 0) becomes permanently unjoinable. This leads to:

  • Funds being locked in the contract indefinitely.

  • A broken gameplay experience for ETH users.

  • Waste of gas and frustration for users trying to join games.

Vulnerability Details

In the contract file : RockPaperScissors.sol

*/
function joinGameWithToken(uint256 _gameId) external {
Game storage game = games[_gameId];
​
require(game.state == GameState.Created, "Game not open to join");
require(game.playerA != msg.sender, "Cannot join your own game");
require(block.timestamp <= game.joinDeadline, "Join deadline passed");
@audit //Here it check for 0 ether but player need to put atleast 0.01 Ether
require(game.bet == 0, "This game requires ETH bet");
require(winningToken.balanceOf(msg.sender) >= 1, "Must have winning token");
​
// Transfer token to contract
winningToken.transferFrom(msg.sender, address(this), 1);
​
game.playerB = msg.sender;
emit PlayerJoined(_gameId, msg.sender);
}

Impact

  • ETH-based games cannot be played at all.

  • ETH sent during game creation becomes locked unless a withdrawal mechanism exists (not provided in the snippet).

  • User funds are potentially frozen permanently.

Tools Used

Manual test

Recommendations

Put bet to be > 0

Updates

Appeal created

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

joinGameWithEth() Function Exists

There IS a joinGameWithEth() function in the contract (lines 145-159) that allows players to join ETH-based games.

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

joinGameWithEth() Function Exists

There IS a joinGameWithEth() function in the contract (lines 145-159) that allows players to join ETH-based games.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.