Hopium

Hopium Web Game Pentest

Zealynx ran a one-week blackbox penetration test of Hopium, a Web2 coin-flip game running on Virtual Rollups ZeroGas infrastructure. Five issues were identified: three Medium (the deposit function should be disabled before starting a game; lack of input validation in the deposit function triggers zero-value transactions and gas griefing; decimals are not required in the deposit function), and two Informational (Strict-Transport-Security not enforced; the reset function is redundant). All five findings were acknowledged at report publication.