Summary

The contract mints new WinningToken tokens during game resolution (completion/cancellation) instead of transferring the originally staked tokens locked in the contract. This creates an infinite supply of tokens and permanently traps user-deposited tokens in the contract.

Vulnerability Details

Affected Components

1. **Token Prize Distribution **

   (`RockPaperScissors::_finishGame` function)

2. Game Cancellation Logic (RockPaperScissors::_cancelGame function)

Key Vulnerable Code Snippets

1. Faulty Minting in Game Completion (RockPaperScissors::_finishGame):

2. Faulty Minting in Game Cancellation (RockPaperScissors::_cancelGame):

Attack Scenarios & Impact

Scenario 1: Infinite Token Minting via Game Cancellation

1. Step 1: Attacker creates a token-based game (transfers 1 WinningToken to the contract).

2. Step 2: Attacker joins their own game with a second account (transfers another token).

3. Step 3: Attacker cancels the game via timeoutJoin.

4. Result:

   • Contract mints 2 new tokens (1 to each "player").

   • Original 2 tokens remain locked in the contract.

   • Total token supply increases by +2 per iteration.

Scenario 2: Infinite Token Minting via Game Completion

1. Step 1: Attacker creates a single-turn token game.

2. Step 2: Attacker completes the game (winning fairly or via timeout).

3. Result:

   • Contract mints 2 new tokens to the winner.

   • Original 2 tokens remain locked in the contract.

   • Total token supply increases by +2 per game.

Impact

• Token Supply: Infinite inflation via unrestricted minting, rendering the token worthless.

• User Funds: All tokens deposited in games are permanently locked in the contract.

• Protocol Integrity: Loss of trust due to broken economic model and inability to honor token redemptions.

Tools Used

Recommendations

1. Replace Minting with Token Transfers:

1. Add Balance Checks:

1. Burn Tokens on ETH Game Wins: