Rock Paper Scissors

Summary

The contract mints tokens to a winner's address based on the game type (ETH or token-based), using the mint function. However, there are no safety checks to ensure that the recipient can actually receive the token

Vulnerability Details

The current minting logic directly uses mint(...), which may succeed even when _winner is a contract that cannot handle tokens.

Malicious or misconfigured contracts could receive tokens they can't use or accidentally lock them forever.

Impact: Medium/Low

• Loss of tokens: Tokens may be minted to contracts that do not support receiving them, causing them to be locked and unusable.

• Unexpected behavior: If _winner is a contract without handling logic, this might silently succeed in unsafe implementations or revert in safer ones.

• Reduced interoperability: Limits the flexibility of game integrations with wallets, proxies, and contract accounts.

Tools Used

Manual review

Recommendations

Use safeMint()