Decimals not handled by the application frontend (Deposit and Withdraw flows reflect into session and rollup balances)
The Deposit and Withdraw flows accepted decimal values, which were reflected immediately into the session balance and rollup balance, creating display drift and potential rounding mismatch between the frontend and the on-chain settlement layer.
Description
The application accepted decimals in the Deposit and Withdraw functions. The decimal value was reflected immediately in the session balance and, later, in the rollup balance.
While bet amounts were always rounded numbers, and Deposit / Withdraw / Finish appeared to handle decimals correctly at the end of the game, this is still classified as High because the application does not explicitly enforce or reject decimal input. The backend (and the on-chain settlement layer) may not be designed to handle the resulting decimal rounding situations cleanly, opening a class of balance-mishandling bugs the application is not expecting.
Impact
- Display drift between the UI numeric formatting (decimals shown verbatim) and the backend handling.
- Potential balance mishandling if any code path assumes integer USDC amounts.
- Gas griefing or settlement failures if the on-chain layer rejects decimal-tail values.
Recommendation
Revise the input on Deposit and Withdraw to constrain user-supplied amounts. If the application does not expect decimals, reject them at the input boundary; if it does, normalize to a fixed-precision representation and use the same canonical numeric format end-to-end (UI, backend, on-chain).
Beecasino: Acknowledged. Zealynx: Acknowledged.