Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Centralization Risk Due to Owner Privileges in WinningToken

0xarektq

Summary

The RockPaperScissors::WinningToken contract uses the Ownable pattern, granting a single address full control over minting tokens. This introduces a centralization risk where a privileged owner can arbitrarily mint new tokens, potentially undermining fairness and trust in the reward system.

Vulnerability Details

The contract inherits from OpenZeppelin’s Ownable, and includes a mint() function restricted to the owner:

contract WinningToken is ERC20, ERC20Burnable, Ownable {
function mint(address to, uint256 amount) external onlyOwner {
_mint(to, amount);
}

Impact

Low

Tools Used

  • Manual Review

  • Context analysis from README.md

Recommendations

  • Restrict minting access to game logic contracts (e.g., RockPaperScissors) instead of a single owner.

  • Use AccessControl or minter roles instead of Ownable.

Updates

Appeal created

m3dython Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Owner is Trusted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.