Rock Paper Scissors

First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Severity: low
Invalid

Incorrect Error Message in joinGameWithToken Function

Summary

The error message in the RockPaperScissors::joinGameWithToken() function, specifically the line:

@> require(game.bet == 0, "This game requires ETH bet");

is misleading and incorrect.

Vulnerability Details

In the RockPaperScissors::joinGameWithToken() function, the following require() statement checks if the game was created without a bet, indicating the game requires a token bet:

require(game.bet == 0, "This game requires ETH bet");

However, the error message "This game requires ETH bet" is incorrect because this function is not designed for ETH-based bets but rather token-based bets (i.e., using the winningToken). The error message should correctly indicate that a token bet is required, not ETH.

Impact

  • User Confusion: The error message may confuse users, as they might believe they need to send ETH instead of tokens when joining the game.

  • Incorrect Expectations: Users attempting to join a token-based game might be unsure about what type of bet is expected due to the incorrect error message referencing ETH.

Recommendations

Update the error message in the joinGameWithToken() function to accurately reflect the requirement that the game is expecting a token bet:

+ require(game.bet == 0, "This game requires token bet, not ETH");
- require(game.bet == 0, "This game requires ETH bet");
Updates

Appeal created

m3dython Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational

Code suggestions or observations that do not pose a direct security risk.

m3dython Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational

Code suggestions or observations that do not pose a direct security risk.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.