Rock Paper Scissors

Summary The WinningToken contract has no supply cap and allows minting of new tokens through internal game logic functions such as _cancelGame() and _finishGame(). Since tokens are minted rather than returned from escrow, players can receive new tokens upon game cancellation, while the original deposited tokens remain locked in the contract, potentially retrievable by the admin. This creates a scenario for infinite token inflation, undermining trust in the token’s value and enabling backdoor minting** **by the contract owner.

Vulnerability Details A malicious admin or automated bot could create fake games between wallets they control, trigger functions that mint new tokens repeatedly, and mint new tokens** **while accumulating the original deposited ones.

Impact 1) Admin can repeatedly call internal functions to mint tokens without real gameplay. 2)Undermines the value and scarcity of the token. 3) Honest players are diluted by maliciously minted tokens

Tools Used manual code review

Recommendations 1)Track player deposits explicitly, and return tokens from escrow, not mint new ones.

• Use a vault or escrow system to securely manage token-based deposits and withdrawals.

• Introduce a maximum total supply and enforce it in the mint() function.