Submission Details
Severity:
[L-131] Wrong place of transferFrom Re-entrancy Risk
Summary
The createGameWithToken function performs the external ERC‑20 transferFrom Call before updating critical game state, enabling a malicious token contract to reenter and corrupt the freshly initialized game data.
Vulnerability Details
If the game state was not updated before the call, then that user reenters that function with the old state and does malicious actions.
Solution
Reorder to Follow Checks → Effects → Interactions
Like that :
uint256 gameId = gameCounter++;
winningToken.transferFrom(msg.sender, address(this), 1);
Rewards breakdown
nSLOC
349This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.