Rock Paper Scissors

Summary

In the RockPaperScissors contract, there are multiple reentrancy points that could be exploited by an attacker, if wrapping the WinningToken in a malicious contract was possible. Therefore, the contract is vulnerable to reentrancy attacks, due to these functions that call external contracts and modify state after the call:

• createGameWithToken()

• joinGameWithToken()

Vulnerability Details

Impact

If an attacker can wrap the WinningToken in a malicious contract, they could exploit the reentrancy vulnerability to drain funds or manipulate the game state.

POC

1. An attacker creates a malicious contract that wraps the WinningToken and implements a reentrancy attack on balanceOf() and transferFrom().

2. The attacker calls createGameWithToken() or joinGameWithToken() with the malicious contract as the winningToken.

3. The attacker can then exploit the reentrancy vulnerabilities to block the process with reverting calls.

4. No other player can create or join a game until the attacker decides to stop the attack.

Tools Used

Aderyn and manual review.

Recommendations

Implement the checks-effects-interactions pattern to avoid changing state after external calls.