Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

[H-03] Missing `TransferFrom` Validation in RockPaperScissors::createGameWithToken and RockPaperScissors::joinGameWithToken

0xshaedyw

Summary

The createGameWithToken() and joinGameWithToken() functions lack proper validation of ERC20 token transfer successes, enabling game state modifications without guaranteed token deposits. This violates the fundamental "checks-effects-interactions" pattern and compromises game integrity.

Vulnerability Details

Location:

  • createGameWithToken()

  • joinGameWithToken()

Vulnerable code:

// In createGameWithToken()
winningToken.transferFrom(msg.sender, address(this), 1); // No return check
​
// In joinGameWithToken()
winningToken.transferFrom(msg.sender, address(this), 1); // No return check

Technical Analysis

  • Both functions use standard ERC20 transferFrom() without:

    • Return value verification

    • Allowance validation

    • Reentrancy protection

Impact

  • Players can participate without token staking

  • Protocol awards prizes without receiving tokens

Tools Used

  • Manual code review

Recommendations

- winningToken.transferFrom(msg.sender, address(this), 1)
​
// For both functions
// Option 1: Explicit return check
+ bool success = winningToken.transferFrom(msg.sender, address(this), 1);
+ require(success, "Transfer failed");
​
// Option 2: SafeERC20 wrapper
import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
using SafeERC20 for IERC20;
​
+ winningToken.safeTransferFrom(msg.sender, address(this), 1);
Updates

Appeal created

m3dython Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing Check on External Call Return Value

ERC20 implementation typically reverts on transfer failures

m3dython Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing Check on External Call Return Value

ERC20 implementation typically reverts on transfer failures

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.