The RockPaperScissors
contract contains a critical validation flaw in the joinGameWithEth()
function. The function fails to validate whether a game requires an ETH bet or a token bet. This allows a malicious player to join token-based games through the ETH betting function without providing the required token to be deposited, essentially participating for free while still being eligible to win the game.
Scenario:
The contract implements two separate functions for joining games: joinGameWithEth()
for ETH-based games and joinGameWithToken()
for token-based games. However, the joinGameWithEth()
function only checks that the sent ETH value matches the game's bet amount without verifying whether the game was intended to be played with tokens or Eth to begin with.
In token-based games, the bet value is set to 0 ETH, but the participant is expected to provide a token. A malicious player can exploit this by calling joinGameWithEth()
with 0 ETH for a token-based game, bypassing the token requirement entirely. It is worth noting that on the other side the joinGameWithToken()
function is validated to be only used for token-based games. This is already implemented with the check require(game.bet == 0, "This game requires ETH bet");
.
Attackers can join token-based games without providing the required token stake.
This creates an unfair advantage as they risk nothing while legitimate players commit their tokens.
If the attacker wins, they collect the opponent's tokens for free.
This fundamentally breaks the game's economic model and trust assumptions.
Scope: All token-based games in the system are affected by this vulnerability.
Foundry
Add a validation check in the joinGameWithEth()
function to ensure it can only be used for ETH-based games:
Consider introducing a specific game type flag in the Game struct to explicitly differentiate between ETH-based and token-based games, making the validation explicit in code.
joinGameWithEth function lacks a check to verify the game was created with ETH
joinGameWithEth function lacks a check to verify the game was created with ETH
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.