Rock Paper Scissors

First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Severity: low
Invalid

Unsafe transfer of token in `RockPaperScissors::createGameWithToken` function.

Summary

The `RockPaperScissors::createGameWithToken` function creates a game for betting one `WinningToken`. But there is unsafe transfer of the token used.
```javascript
function createGameWithToken(uint256 _totalTurns, uint256 _timeoutInterval) external returns (uint256) {
require(winningToken.balanceOf(msg.sender) >= 1, "Must have winning token");
require(_totalTurns > 0, "Must have at least one turn");
require(_totalTurns % 2 == 1, "Total turns must be odd");
require(_timeoutInterval >= 5 minutes, "Timeout must be at least 5 minutes");
// Transfer token to contract
@> winningToken.transferFrom(msg.sender, address(this), 1);
```
Here the `transferFrom` function always return true valu even if the token will not transfer properly, Also return value is ignored by the `createGameWithToken` function. Due to this issue the game will be created even if the token is not transfered to the game contract.

Impact

It is possible that token will not transfer properly but the game will be created and the prize will be distributed.

Recommendations

Use `safeERC20` for transfering the token via `safeTransferFrom` function, Which ensures the non-reverting transactions should be assumed to successfull and if the token will not transfer then the function will be reverted.
```diff
+ use safeERC20 for ERC20;
```
Also update the `createGameWithToken` function.
```diff
function createGameWithToken(uint256 _totalTurns, uint256 _timeoutInterval) external returns (uint256) {
...
...
// Transfer token to contract
- winningToken.transferFrom(msg.sender, address(this), 1);
+ winningToken.safeTransferFrom(msg.sender, address(this), 1);
...
```
Also update the functions which have this type of issue.

Updates

Appeal created

m3dython Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
m3dython Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.