Rock Paper Scissors

First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Severity: low
Valid

Unchecked minting of tokens in tie scenarios

Summary:

In the event of a tie, the game contract mints one token each for both players, regardless of whether they had previously deposited tokens.

Vulnerability Details:

Suppose an attacker creates the game with token and another attacker joins the game with token . Now both make tie knowlingly and make the contract to mint new tokens. However the token deposited intially by both the attacker's stay in the contract. ANd new token is minted.

Location:

function _handleTie(uint256 _gameId) internal
function _cancelGame(uint256 _gameId) internal
// Return tokens for token games
if (game.bet == 0) {
winningToken.mint(game.playerA, 1);
winningToken.mint(game.playerB, 1);

Impact :

1.Token Devaluation:

2.Users may lose confidence in the token's stability, affecting adoption and usage

Tools Used : Mannual Review

Recommendations:

Clearly outline minting and burning policies in documentation to maintain user trust.

Updates

Appeal created

m3dython Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Minting Instead of Transferring Staked Tokens

Mints new tokens upon game completion or cancellation for token-based games

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.