Vulnerability Details

Bug Description

The contract improperly handles token refunds when a game is cancelled or finished. Instead of returning the originally staked tokens it holds, it mints new tokens to players.

This leads to two critical issues:

1. Staked tokens remain permanently locked in the contract.

2. The total supply of tokens increases with every game, even when there is no net winner.

This issue is not only a flaw in business logic but also creates a hidden inflation loop that can damage the token economy and user trust over time.

Impact

• Unbounded Inflation: Every game adds new tokens to circulation. Over time, this leads to significant supply inflation.

• Token Devaluation: With more tokens minted than necessary, the value of each token decreases, disincentivizing holders and undermining token economics.

• Contract Token Sink: The contract builds up a stockpile of unused tokens that are effectively burned, but without reducing the total supply. These tokens become permanently inaccessible.

• Inaccurate Token Metrics: On-chain token supply and distribution metrics become misleading, affecting integrations, analytics, and investor perception.

Tools Used

• Manual Review of RockPaperScissors.sol

• Logical trace of _cancelGame() and _handleFinish() execution paths

• Understanding of ERC-20 behavior and minting implications

Recommended Mitigation Steps

1. Stop Minting Tokens for Refunds

   • Eliminate the use of winningToken.mint(...) in _cancelGame() and _handleFinish().

2. Use Stored/Staked Tokens for Payouts

   • When players stake tokens at game start, store them safely in the contract.

   • Upon game completion (win, tie, or cancel), transfer these same tokens back to the appropriate players:

     winningToken.transfer(playerA, 1);

     winningToken.transfer(playerB, 1);

     ​

3. Add a Recovery Fallback (Optional)

   • Consider implementing an emergency admin function to recover and redistribute any locked tokens, if needed, for legacy games.

4. Audit for Supply Alignment

   • Ensure that token balances and total supply remain in sync throughout the game lifecycle. Supply should only increase through legitimate means (e.g., rewards, governance-mandated minting).