Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

[H-05] Orphaned ETH Vulnerability in RockPaperScissors::receive()

0xshaedyw

Summary

The unrestricted receive() function allows direct ETH transfers that become permanently locked in the contract, providing no utility while creating fund loss risks.

Vulnerability Details

Affected Component

receive() external payable {
// Empty implementation
}

Technical Analysis

  1. Silent Acceptance:

    • ETH transfers succeed without reverting

    • No connection to game logic

  2. Storage Impact:

    • Increases contract balance irreversibly

    • No corresponding game state changes

Attack Scenario

Actors:

  • Patrick (Accidental User)

  • Contract (Victim)

Steps:

  • Patrick sends ETH directly:

    (bool success, ) = address(rps).call{value: 1 ether}("");

  • Transaction succeeds (no revert)

  • Resulting State:

    • Contract balance increases by 1 ETH

    • No game created

    • No refund mechanism exists

Impact

  • Any ETH sent to the contract address is permanently locked.

Tools Used

  • Manual Code Review

Recommendations

1) Immediate Fix (Option A)

receive() external payable {
revert("Use createGameWithEth()");
}

2) Credit System (Option B)

mapping(address => uint256) public ethCredits;
​
receive() external payable {
ethCredits[msg.sender] += msg.value;
emit CreditsDeposited(msg.sender, msg.value);
}
Updates

Appeal created

m3dython Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Orphaned ETH due to Unrestricted receive() or Canceled Game

ETH sent directly to the contract via the receive function or after a canceled game becomes permanently locked

m3dython Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Orphaned ETH due to Unrestricted receive() or Canceled Game

ETH sent directly to the contract via the receive function or after a canceled game becomes permanently locked

0xshaedyw Submitter
2 months ago
0xshaedyw Submitter
2 months ago
m3dython Lead Judge
2 months ago
m3dython Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Orphaned ETH due to Unrestricted receive() or Canceled Game

ETH sent directly to the contract via the receive function or after a canceled game becomes permanently locked

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.