Rock Paper Scissors

Summary The RockPaperScissors contract mints new WinningToken tokens to refund players when a token-based game is canceled. However, it does not return the actual deposited tokens, which remain in the contract. This leads to duplicated tokens and unchecked inflation, which can be abused by the contract owner.

Vulnerability Details In the _cancelGame function: if (game.bet == 0) {
if (game.playerA != address(0)) {
winningToken.mint(game.playerA, 1);
}
if (game.playerB != address(0)) {
winningToken.mint(game.playerB, 1);
}
}. The logic mints new tokens** to refund players when they cancel a token-based game. However, when the game is initialized, players deposit existing tokens **into the contract — which are never burned or returned upon cancellation. The original tokens accumulate in the contract, while new tokens are minted to players. This means the admin (or any party with access to those contract-held tokens in future upgrades or added features) could potentially withdraw or manipulate the token supply without proper on-chain accounting.

Impact Could be used to farm free tokens by repeatedly creating and canceling games.

Tools Used manual code review

Recommendations Return original deposited tokens** **instead of minting new ones