Rock Paper Scissors

Summary The joinGameWithToken function displays an incorrect error message suggesting that ETH is required, even though the function is meant for joining a game using the game’s custom token.

Vulnerability Inside the joinGameWithToken(uint256 _gameId) function, this line:

CopyEdit

require(game.bet == 0, "This game requires ETH bet");

…is misleading and technically incorrect. This function is meant for players who want to join a game with the game token, not ETH. There's a separate function for ETH-based games. So the message may confuse developers, auditors, or users reading logs into thinking ETH is required here, which it’s not.

IMPACT it introduces potential confusion and could cause misinterpretation during debugging, auditing, or usage.

Tools Used manual code review

Recommendations require(game.bet == 0, "Use game token to join, not ETH");