Summary

There is no check to ensure _winner == game.player1 || _winner == game.player2.

Vulnerability Details

The _finishGame function directly uses the _winner parameter to transfer ETH and mint tokens without validating that _winner is a legitimate participant in the game:

Impact

A malicious actor or a bug in external logic could call _finishGame with an arbitrary address as _winner, leading to:

Unauthorized transfer of the prize pool (ETH).

Unauthorized minting of reward tokens.

Tools Used

Manual code review

Recommendations

Add an explicit check at the beginning of _finishGame, This ensures the reward distribution is only performed for legitimate players of the game.