Rock Paper Scissors

Summary

A critical vulnerability exists in the Rock-Paper-Scissors game smart contract's token handling mechanism where user-contributed tokens are permanently locked in the contract instead of being returned to players. When users join token-based games (where game.bet = 0), they transfer tokens to the contract, but during game completion, the contract mints new tokens instead of returning the original ones. This results in token inflation and permanent loss of users original tokens.

Vulnerability Details

The issue involves three contract functions:

In the joinGameWithToken function, players transfer tokens to the contract:

However, in the _finishGame function, instead of transferring these tokens back, new tokens are minted:

Similarly, in the handleTie function, new tokens are minted rather than returning original tokens:

This creates several significant problems:

1. The original tokens transferred by players to the contract are never returned or used

2. These tokens remain permanently locked in the contract with no mechanism to retrieve them

3. Each completed game increases the total token supply, causing inflation

4. Both players' originally staked tokens are effectively burned

Impact

• Players permanently lose their original tokens staked in the game.

• Every completed token-based game increases the token supply by either 1 token (when there's a winner who receives 2 tokens) or 2 tokens (when there's a tie).

• The contract accumulates tokens with no mechanism to distribute them.

Tools Used

Manual code review

Recommendations

Modify the token prize distribution logic to return the original tokens rather than minting new ones:

• For the _finishGame function:

• For the handleTie function:

Additionally, consider implementing a token accounting system like a mapping to keep track of tokens in the contract and ensure the contract always has enough tokens to distribute back to users.