Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

[H-03] Missing `TransferFrom` Validation in RockPaperScissors::createGameWithToken and RockPaperScissors::joinGameWithToken

0xshaedyw

Summary

The createGameWithToken() and joinGameWithToken() functions lack proper validation of ERC20 token transfer successes, enabling game state modifications without guaranteed token deposits. This violates the fundamental "checks-effects-interactions" pattern and compromises game integrity.

Vulnerability Details

Location:

  • createGameWithToken()

  • joinGameWithToken()

Vulnerable code:

// In createGameWithToken()
winningToken.transferFrom(msg.sender, address(this), 1); // No return check
​
// In joinGameWithToken()
winningToken.transferFrom(msg.sender, address(this), 1); // No return check

Technical Analysis

  • Both functions use standard ERC20 transferFrom() without:

    • Return value verification

    • Allowance validation

    • Reentrancy protection

Impact

  • Players can participate without token staking

  • Protocol awards prizes without receiving tokens

Tools Used

  • Manual code review

Recommendations

- winningToken.transferFrom(msg.sender, address(this), 1)
​
// For both functions
// Option 1: Explicit return check
+ bool success = winningToken.transferFrom(msg.sender, address(this), 1);
+ require(success, "Transfer failed");
​
// Option 2: SafeERC20 wrapper
import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
using SafeERC20 for IERC20;
​
+ winningToken.safeTransferFrom(msg.sender, address(this), 1);
Updates

Appeal created

m3dython Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing Check on External Call Return Value

ERC20 implementation typically reverts on transfer failures

m3dython Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Missing Check on External Call Return Value

ERC20 implementation typically reverts on transfer failures

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!