Summary

The RockPaperScissors.sol contract allows users to stake (WinningToken) ERC20 tokens for playing games. However, in cases of game cancellation, the contract mints new tokens instead of returning the transferred tokens to users. This results in token inflation and the permanent loss of user tokens.

This issue allows attackers to farm tokens by repeatedly creating games that no one joins, leading to uncontrolled token supply inflation.

Vulnerability Details

The vulnerability arises in the cancellation paths of the contract, where instead of transferring the deposited tokens back to the user, new tokens are minted. The function responsible for this is _cancelGame() and _handleTie(), where:

Impact

• Token Inflation: The minting of new tokens on every game cancellation causes the token supply to increase without a corresponding increase in value or assets, leading to inflation.

• Permanent Loss of Tokens: The escrowed tokens are locked within the contract when the game is cancelled, meaning players cannot retrieve their original stake.

Recommendations

Replace Mint with Token Transfer: Instead of minting new tokens, the contract should transfer the original deposited tokens back to the players in the event of a game cancellation.