Submission Details
Severity:
Invalid Enum Values Accepted in Move Input
Summary
Solidity enums default to uint8, and unchecked input values can cast to invalid enum states.
Vulnerability Details
enum Move { Rock, Paper, Scissors }
function playMove(Move move) external {
// No validation of move value
}
This allows casting of invalid values like 3, 4, 255 to undefined states, which can break logic or force undefined behavior in comparisons.
Impact
Denial of service
Inconsistent game outcomes
Tools Used
Manual review
Fuzz testing
Recommendations
Validate input before casting:
function playMove(uint8 _move) public {
require(_move <= 2, "Invalid move");
Move move = Move(_move);
}
Updates
Appeal created
m3dython about 2 months ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
Informational
Code suggestions or observations that do not pose a direct security risk.
Rewards breakdown
nSLOC
349This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.