Rock Paper Scissors

Summary

In the _handleTie() function, ETH refunds to both players are attempted using low-level .call{value:}. If either transfer fails, the function reverts entirely due to the require(successA && successB, "Transfer failed"); check. This causes all refunds to fail, even if one transfer was successful, potentially locking funds in the contract permanently.

Vulnerability Details

• If either playerA or playerB cannot receive ETH (e.g., a contract with a failing receive() function), the entire transaction reverts.

• No alternative handling (e.g., retry logic or partial refunds) is implemented.

Impact

• If one of the players is a contract without a payable fallback or actively reverts, both players are denied their refund.

• This can result in locked ETH with no recovery mechanism unless a separate admin refund is added.

• A malicious player could intentionally deploy a rejecting contract to block refunds for others.

Tools Used

manual, foundry

Recommendations

• allow partial refund

  Handle transfer seperately with event