Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

`RockPaperScissors` excessively mints `WinningToken` instead of using `transfer`, causing an inflated `totalSupply`

37h3rn17y2

Summary

During a Token game, WinningToken token bets are transferred from players to the RockPaperScissors contract. However, during win/tie/cancel conditions, RockPaperScissors contract mints new WinningTokens to the players instead of transferring them to the player. This results in an artificially inflated totalSupply of WinningTokens.

RockPaperScissors::_finishGame#L498

if (game.bet == 0) {
// Mint a winning token
@> winningToken.mint(_winner, 2);
} else {

RockPaperScissors::_handleTie#L535-536

if (game.bet == 0) {
@> winningToken.mint(game.playerA, 1);
@> winningToken.mint(game.playerB, 1);
}

RockPaperScissors::_cancelGame#L566&569

if (game.bet == 0) {
if (game.playerA != address(0)) {
@> winningToken.mint(game.playerA, 1);
}
if (game.playerB != address(0)) {
@> winningToken.mint(game.playerB, 1);
}
}

Impact

Impact: Low, the inflated WinningTokens are locked in the RockPaperScissors contract and are not circulating, it is just that totalSupply is artificially inflated
Likelihood: High, this happens in all win/tie/cancel conditions
Severity: Low

Tools Used

Manual review

Recommendations

Use transfer instead of mint

RockPaperScissors::_finishGame#L498

if (game.bet == 0) {
// Mint a winning token
- winningToken.mint(_winner, 2);
+ winningToken.transfer(_winner, 2);
} else {

RockPaperScissors::_handleTie#L535-536

if (game.bet == 0) {
- winningToken.mint(game.playerA, 1);
- winningToken.mint(game.playerB, 1);
+ winningToken.transfer(game.playerA, 1);
+ winningToken.transfer(game.playerB, 1);
}

RockPaperScissors::_cancelGame#L566&569

if (game.bet == 0) {
if (game.playerA != address(0)) {
- winningToken.mint(game.playerA, 1);
+ winningToken.transfer(game.playerA, 1);
}
if (game.playerB != address(0)) {
- winningToken.mint(game.playerB, 1);
+ winningToken.transfer(game.playerB, 1);
}
}
Updates

Appeal created

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Minting Instead of Transferring Staked Tokens

Mints new tokens upon game completion or cancellation for token-based games

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Minting Instead of Transferring Staked Tokens

Mints new tokens upon game completion or cancellation for token-based games

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.