Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Misleading Error Message in joinGameWithToken Function

0xblackadam

Summary

The joinGameWithToken function in the RockPaperScissors contract contains a misleading error message that contradicts the actual requirement being checked. The function verifies that game.bet == 0 to ensure the game being joined is a token-based game rather than an ETH-based game, but the error message incorrectly states "This game requires ETH bet" when the exact opposite is true.

Vulnerability Details

The issue is found in the joinGameWithToken function:

function joinGameWithToken(uint256 _gameId) external {
Game storage game = games[_gameId];
​
require(game.state == GameState.Created, "Game not open to join");
require(game.playerA != msg.sender, "Cannot join your own game");
require(block.timestamp <= game.joinDeadline, "Join deadline passed");
require(game.bet == 0, "This game requires ETH bet"); // <-- This line has the misleading message
require(winningToken.balanceOf(msg.sender) >= 1, "Must have winning token");
​
// Transfer token to contract
winningToken.transferFrom(msg.sender, address(this), 1);
​
game.playerB = msg.sender;
emit PlayerJoined(_gameId, msg.sender);
}

The function is designed to allow users to join token-based games, where the bet amount (game.bet) should be 0. However, the error message indicates the opposite requirement, stating "This game requires ETH bet" when the check fails.

Impact

  • User Experience: Users may be confused by the error message, as it contradicts what they're trying to do.

  • Integration: Developers integrating with this contract might misinterpret the requirements based on the error message.

  • Debugging: The misleading message could complicate debugging efforts during development or maintenance.

The issue is especially problematic because the error message directly contradicts the check's purpose, potentially causing confusion rather than providing helpful guidance.

Tools Used

  • Manual code review

Recommendations

  • Replace the misleading error message with an accurate description:

require(game.bet == 0, "This game requires token bet, not ETH");
Updates

Appeal created

m3dython Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational

Code suggestions or observations that do not pose a direct security risk.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.