Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Joining the game with no winning token is possible.

asteriknight

Summary

An attacker can join the game without tokens, breaking the protocol's base assumption.

Vulnerability Details

Let's assume player A created a game using the createGameWithToken function. Then, player B can bypass the validation and token transfer process using the joinGameWithEth function since there is no preventing rule for this.

Impact

The two main threat scenarios that this vulnerability can trigger are as follows:

  • Player B can join any game created with the createGameWithToken function without risk, gaining a 50% chance to seize the opponent's tokens.

  • Since the game can be established with only a single token and the winner receives two, if two players cooperate, they could theoretically generate an infinite number of tokens.

These could lead to the following damages:

  • Disrupt the protocol's functionality

  • Indirect fund loss (If tokens can be generated infinitely, people won't play ETH-based games, making it difficult for the Admin to earn revenue through fees.)

Tools Used

  • None

Recommendations

function joinGameWithEth(uint256 _gameId) external payable {
Game storage game = games[_gameId];
​
require(game.state == GameState.Created, "Game not open to join");
require(game.playerA != msg.sender, "Cannot join your own game");
require(block.timestamp <= game.joinDeadline, "Join deadline passed");
// require(game.bet > 0 && msg.value == game.bet, "Bet amount must match creator's bet");
require(msg.value == game.bet, "Bet amount must match creator's bet");
​
game.playerB = msg.sender;
emit PlayerJoined(_gameId, msg.sender);
}

  • In joinGameWithEth, add logic to check whether the game is ETH-based or token-based.

Updates

Appeal created

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game Staking Inconsistency

joinGameWithEth function lacks a check to verify the game was created with ETH

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game Staking Inconsistency

joinGameWithEth function lacks a check to verify the game was created with ETH

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.