Rock Paper Scissors

Summary

The RockPaperScissors contract implements insufficient validation for ERC20 token transfers in both functions createGameWithToken() and joinGameWithToken(), potentially allowing silent failures in the token transfer process. The developer included a balance check before calling transferFrom(), indicating awareness of potential silent failures, but this approach is fundamentally flawed. The check only validates the user's balance but completely ignores token allowances, making it ineffective against the most common cause of transfer failures. Additionally, using the standard transferFrom() without proper return value checking or using the SafeERC20 library exposes the contract to non-compliant ERC20 implementations.

Vulnerability Details

In the contract functions that handle token transfers, the developer implements a check that verifies the user has sufficient token balance:

This approach reveals two major issues:

• The balance check does not validate that the user has approved the contract to spend their tokens. Even if the user has sufficient balance, the transaction will still fail if the allowance is insufficient.

• The direct use of transferFrom() without checking the return value or using the SafeERC20 library can lead to silent failures with non-compliant tokens that don't revert on failure or return false without reverting.

The presence of the balance check suggests the developer is aware of potential issues with the token implementation but did not properly address them. A truly secure implementation would use the SafeERC20 library, which properly handles both non-reverting and non-returning token implementations.

Impact

• Token transfers may silently fail, causing game states to advance without proper token transfers.

• Users could participate in token-based games without actually contributing tokens.

Tools Used

• Foundry

Recommendations

Replace direct token transfer calls with SafeERC20 library usage.