Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

A contract account without a fallback or a receive payable function can not receive ETH and the `RockPaperScissors` contract owner can not receive the fees associated to this game.

rayno_44

Summary

In the RockPaperScissors::_finishGame, the prize is sent directly to the winner without checking if it can receive it. This can fail if it is a contract account without a fallback or a receive payable function. The transaction will revert, the game state will not be updated to Finished and the RockPaperScissors contract owner will never be able to withdraw the fees associated to this game.

Vulnerability Details

In the RockPaperScissors::_finishGame function, there is no check to see if a winner is a contract account. If it is a contract account and if it doesn't have a fallback or a receive payable function, it will never get the prize because the RockPaperScissors::_finishGame function will fail all the time. There will be no possibility also for the RockPaperScissors contract owner to withdraw the fees associated to this game and the funds will be locked in the contract.

function _finishGame(uint256 _gameId, address _winner) internal {
// Handle ETH prizes
if (game.bet > 0) {
// Calculate total pot and fee
uint256 totalPot = game.bet * 2;
uint256 fee = (totalPot * PROTOCOL_FEE_PERCENT) / 100;
prize = totalPot - fee;
​
// Accumulate fees for admin to withdraw later
accumulatedFees += fee;
emit FeeCollected(_gameId, fee);
​
// Send prize to winner
(bool success, ) = _winner.call{value: prize}("");
@> //@audit function execution will fail if _winner is a contract account
//without receive or fallback paybale function
require(success, "Transfer failed");
}
}

Impact

The funds associated to the game will be locked in the RockPaperScissors contract without possibility to withdraw them.

Tools Used

Manual review

Recommendations

You should implement a pull-based reward mechanism where each winner of a game can claim their prize. Additionally, ensure that the RockPaperScissors contract owner can withdraw the collected fees independently of whether the winner claims their reward.

Updates

Appeal created

m3dython Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Denial of Service (DoS) due to Unhandled External Call Revert

Malicious player wins a game using a contract that intentionally reverts when receiving ETH, the entire transaction will fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.