Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Unsafe ERC-20 Transfer in `RockPaperScissors::joinGameWithToken` Allows Silent Token Transfer Failures

nhippolyt

Summary

The RockPaperScissors::joinGameWithToken function uses transferFrom to transfer WinningToken tokens to the contract but does not safely handle non-compliant ERC-20 tokens. This could allow players to join token-based games without actually transferring tokens, breaking game fairness and prize distribution.

Vulnerability Details

Affected Code

function joinGameWithToken(uint256 _gameId) external {
// ...
winningToken.transferFrom(msg.sender, address(this), 1); // Unsafe transfer
// ...
}

The function assumes the WinningToken contract reverts on failed transfers. However, if the token follows the ERC-20 standard without reverting on failure (e.g., returns false instead), the transfer could fail silently. This occurs because transferFrom is called without checking its return value.

Impact

  • Players can join games without locking tokens, allowing free participation.

  • Games may lack valid token deposits, making prizes unbacked.

Tools Used

Recommendations

Replace transferFrom with OpenZeppelin’s SafeERC20.safeTransferFrom, which handles both reverting and non-reverting ERC-20 tokens:

import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
​
function joinGameWithToken(uint256 _gameId) external {
// ...
SafeERC20.safeTransferFrom(winningToken, msg.sender, address(this), 1); // Safe transfer
// ...
}
Updates

Appeal created

m3dython Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Broken Token Game Creation

createGameWithToken and joinGameWithToken functions will revert because they attempt transferFrom without requiring the user to first approve

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.