Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

DOS caused by external call failure

arkaudits

Summary

Denial of Service can occur for a player when their opponent fails to receive funds. The player will be unable to cancel/tie the game, therefore the player will be unable to be refunded ETH.

Vulnerability Details

The functions RockPaperScissors::_handleTie(uint256 _gameId) and RockPaperScissors::_cancelGame(uint256 _gameId) contain external calls to the addresses of both players.

A problem arises when a call to one of the players fails.

Let's examine the following code from _cancelGame which attempts to refund both players:

// Refund ETH to players
if (game.bet > 0) {
(bool successA,) = game.playerA.call{value: game.bet}("");
require(successA, "Transfer to player A failed");
​
if (game.playerB != address(0)) {
(bool successB,) = game.playerB.call{value: game.bet}("");
require(successB, "Transfer to player B failed");
}
}

If successA is false, then the logic for refunding playerB is never reached. Likewise, if successB is false, then the transaction is reverted and playerA is not refunded.

Impact

A player will be unable to cancel or tie their game if the other player fails to receive their funds. This means that a malicious actor could utilize a Smart Contract to revert the transaction upon receiving the funds, effectively locking the ETH that was bet by both players.

Tools Used

Manual Review.

Recommendations

It is recommended to simply change the game state to Cancelled or Finished in _cancelGame and _handleTie respectively. Afterwards, it is recommended implement a separate function allowing players to withdraw their refunds individually.

Updates

Appeal created

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Denial of Service (DoS) due to Unhandled External Call Revert

Malicious player wins a game using a contract that intentionally reverts when receiving ETH, the entire transaction will fail

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.