Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

[H-06] Missing Allowance Check in `RockPaperScissors::createGameWithToken()`

0xshaedyw

Summary

The createGameWithToken() function fails to verify whether the contract has spending allowance for the player's tokens before attempting to transfer them. This violates the ERC20 standard security pattern and could lead to failed transactions or inconsistent game states.

Vulnerability Details

function createGameWithToken(uint256 _totalTurns, uint256 _timeoutInterval) external returns (uint256) {
winningToken.transferFrom(msg.sender, address(this), 1); // No allowance check
// ... game creation logic ...
}

1) Current Implementation:

  • Skips the critical approve() verification step

  • Assumes unlimited allowance by default

2) Failure Modes:

  • Silent transaction failures when allowance = 0

  • Partial allowance exploitation (e.g., 0.9 tokens approved)

Impact

  • Game IDs created without token transfers

Tools Used

  • Manual code review

Recommendations

function createGameWithToken(uint256 _totalTurns, uint256 _timeoutInterval) external returns (uint256) {
// Add allowance check
require(
winningToken.allowance(msg.sender, address(this)) >= 1,
"Contract not approved to spend tokens"
);
winningToken.safetransferFrom(msg.sender, address(this), 1);
// ... rest of logic ...
}
Updates

Appeal created

m3dython Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Broken Token Game Creation

createGameWithToken and joinGameWithToken functions will revert because they attempt transferFrom without requiring the user to first approve

m3dython Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Broken Token Game Creation

createGameWithToken and joinGameWithToken functions will revert because they attempt transferFrom without requiring the user to first approve

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.