fix: correct game logic, harden security, and improve test reliability

blackjack/encrypted-ixs/src/lib.rs

@@ -61,20 +61,10 @@ mod circuits {
 
         let mut player_hand = player_hand_ctxt.to_arcis().unpack();
 
-        let player_hand_value = calculate_hand_value(&player_hand, player_hand_size);
+        let card_index = (player_hand_size + dealer_hand_size) as usize;
+        player_hand[player_hand_size as usize] = deck[card_index];
 
-        let is_bust = player_hand_value > 21;
-
-        let new_card = if !is_bust {
-            let card_index = (player_hand_size + dealer_hand_size) as usize;
-
-            // Get the next card from the deck
-            deck[card_index]
-        } else {
-            53
-        };
-
-        player_hand[player_hand_size as usize] = new_card;
+        let is_bust = calculate_hand_value(&player_hand, player_hand_size + 1) > 21;
 
         (
             player_hand_ctxt.owner.from_arcis(Pack::new(player_hand)),
@@ -98,24 +88,14 @@ mod circuits {
         player_hand_size: u8,
         dealer_hand_size: u8,
     ) -> (Enc<Shared, Hand>, bool) {
-        let deck_array = deck_ctxt.to_arcis().unpack();
+        let deck = deck_ctxt.to_arcis().unpack();
 
         let mut player_hand = player_hand_ctxt.to_arcis().unpack();
 
-        let player_hand_value = calculate_hand_value(&player_hand, player_hand_size);
+        let card_index = (player_hand_size + dealer_hand_size) as usize;
+        player_hand[player_hand_size as usize] = deck[card_index];
 
-        let is_bust = player_hand_value > 21;
-
-        let new_card = if !is_bust {
-            let card_index = (player_hand_size + dealer_hand_size) as usize;
-
-            // Get the next card from the deck
-            deck_array[card_index]
-        } else {
-            53
-        };
-
-        player_hand[player_hand_size as usize] = new_card;
+        let is_bust = calculate_hand_value(&player_hand, player_hand_size + 1) > 21;
 
         (
             player_hand_ctxt.owner.from_arcis(Pack::new(player_hand)),
@@ -136,10 +116,10 @@ mod circuits {
         let mut dealer = dealer_hand_ctxt.to_arcis().unpack();
         let mut size = dealer_hand_size as usize;
 
-        for _ in 0..7 {
+        for _ in 0..9 {
             let val = calculate_hand_value(&dealer, size as u8);
-            if val < 17 {
-                let idx = (player_hand_size as usize + size) as usize;
+            if val < 17 && size < 11 {
+                let idx = player_hand_size as usize + size;
                 dealer[size] = deck_array[idx];
                 size += 1;
             }
@@ -164,35 +144,31 @@ mod circuits {
     /// # Returns
     /// The total value of the hand (1-21, or >21 if busted)
     fn calculate_hand_value(hand: &[u8; 11], hand_length: u8) -> u8 {
-        let mut value = 0;
-        let mut has_ace = false;
+        let mut value: u8 = 0;
+        let mut ace_count: u8 = 0;
 
-        // Process each card in the hand
         for i in 0..11 {
-            let rank = if i < hand_length as usize {
-                hand[i] % 13 // Card rank (0=Ace, 1-9=pip cards, 10-12=face cards)
-            } else {
-                0
-            };
-
             if i < hand_length as usize {
-                if rank == 0 {
-                    // Ace: start with value of 11
-                    value += 11;
-                    has_ace = true;
-                } else if rank > 10 {
-                    // Face cards (Jack, Queen, King): value of 10
-                    value += 10;
-                } else {
-                    // Pip cards (2-10): face value (rank 1-9 becomes value 1-9)
-                    value += rank;
+                let card = hand[i];
+                if card <= 51 {
+                    let rank = card % 13; // 0=Ace, 1=2, ..., 9=10, 10=J, 11=Q, 12=K
+                    if rank == 0 {
+                        value += 11;
+                        ace_count += 1;
+                    } else if rank <= 9 {
+                        value += rank + 1;
+                    } else {
+                        value += 10;
+                    }
                 }
             }
         }
 
-        // Convert Ace from 11 to 1 if hand would bust with 11
-        if value > 21 && has_ace {
-            value -= 10;
+        for _ in 0..11 {
+            if value > 21 && ace_count > 0 {
+                value -= 10;
+                ace_count -= 1;
+            }
         }
 
         value

blackjack/programs/blackjack/src/lib.rs

@@ -47,11 +47,6 @@ pub mod blackjack {
         blackjack_game.bump = ctx.bumps.blackjack_game;
         blackjack_game.game_id = game_id;
         blackjack_game.player_pubkey = ctx.accounts.payer.key();
-        blackjack_game.player_hand = [0; 32];
-        blackjack_game.dealer_hand = [0; 32];
-        blackjack_game.deck_nonce = 0;
-        blackjack_game.client_nonce = 0;
-        blackjack_game.dealer_nonce = 0;
         blackjack_game.player_enc_pubkey = client_pubkey;
         blackjack_game.game_state = GameState::Initial;
         blackjack_game.player_hand_size = 0;
@@ -184,6 +179,10 @@ pub mod blackjack {
             !ctx.accounts.blackjack_game.player_has_stood,
             ErrorCode::InvalidMove
         );
+        require!(
+            ctx.accounts.blackjack_game.player_hand_size < 11,
+            ErrorCode::InvalidMove
+        );
 
         let args = ArgBuilder::new()
             // Deck
@@ -247,9 +246,10 @@ pub mod blackjack {
         let blackjack_game = &mut ctx.accounts.blackjack_game;
         blackjack_game.player_hand = player_hand;
         blackjack_game.client_nonce = client_nonce;
+        blackjack_game.player_hand_size += 1;
 
         if is_bust {
-            blackjack_game.game_state = GameState::DealerTurn;
+            blackjack_game.game_state = GameState::Resolving;
             emit!(PlayerBustEvent {
                 client_nonce,
                 game_id: blackjack_game.game_id,
@@ -261,7 +261,6 @@ pub mod blackjack {
                 client_nonce,
                 game_id: blackjack_game.game_id,
             });
-            blackjack_game.player_hand_size += 1;
         }
 
         Ok(())
@@ -287,6 +286,10 @@ pub mod blackjack {
             !ctx.accounts.blackjack_game.player_has_stood,
             ErrorCode::InvalidMove
         );
+        require!(
+            ctx.accounts.blackjack_game.player_hand_size < 11,
+            ErrorCode::InvalidMove
+        );
 
         let args = ArgBuilder::new()
             // Deck
@@ -350,10 +353,11 @@ pub mod blackjack {
         let blackjack_game = &mut ctx.accounts.blackjack_game;
         blackjack_game.player_hand = player_hand;
         blackjack_game.client_nonce = client_nonce;
+        blackjack_game.player_hand_size += 1;
         blackjack_game.player_has_stood = true;
 
         if is_bust {
-            blackjack_game.game_state = GameState::DealerTurn;
+            blackjack_game.game_state = GameState::Resolving;
             emit!(PlayerBustEvent {
                 client_nonce,
                 game_id: blackjack_game.game_id,
@@ -435,16 +439,14 @@ pub mod blackjack {
         blackjack_game.player_has_stood = true;
 
         if is_bust {
-            // This should never happen
-            blackjack_game.game_state = GameState::PlayerTurn;
+            blackjack_game.game_state = GameState::Resolving;
             emit!(PlayerBustEvent {
                 client_nonce: blackjack_game.client_nonce,
                 game_id: blackjack_game.game_id,
             });
         } else {
             blackjack_game.game_state = GameState::DealerTurn;
             emit!(PlayerStandEvent {
-                is_bust,
                 game_id: blackjack_game.game_id
             });
         }
@@ -608,41 +610,22 @@ pub mod blackjack {
             Err(_) => return Err(ErrorCode::AbortedComputation.into()),
         };
 
-        if result == 0 {
-            // Player busts (dealer wins)
-            emit!(ResultEvent {
-                winner: "Dealer".to_string(),
-                game_id: ctx.accounts.blackjack_game.game_id,
-            });
-        } else if result == 1 {
-            // Dealer busts (player wins)
-            emit!(ResultEvent {
-                winner: "Player".to_string(),
-                game_id: ctx.accounts.blackjack_game.game_id,
-            });
-        } else if result == 2 {
-            // Player wins
-            emit!(ResultEvent {
-                winner: "Player".to_string(),
-                game_id: ctx.accounts.blackjack_game.game_id,
-            });
-        } else if result == 3 {
-            // Dealer wins
-            emit!(ResultEvent {
-                winner: "Dealer".to_string(),
-                game_id: ctx.accounts.blackjack_game.game_id,
-            });
-        } else {
-            // Push (tie)
-            emit!(ResultEvent {
-                winner: "Tie".to_string(),
-                game_id: ctx.accounts.blackjack_game.game_id,
-            });
-        }
+        let winner = match result {
+            0 | 3 => "Dealer",
+            1 | 2 => "Player",
+            4 => "Tie",
+            _ => return Err(ErrorCode::InvalidGameResult.into()),
+        };
 
         let blackjack_game = &mut ctx.accounts.blackjack_game;
+        blackjack_game.game_result = result;
         blackjack_game.game_state = GameState::Resolved;
 
+        emit!(ResultEvent {
+            winner: winner.to_string(),
+            game_id: blackjack_game.game_id,
+        });
+
         Ok(())
     }
 }
@@ -826,8 +809,9 @@ pub struct PlayerHit<'info> {
         mut,
         seeds = [b"blackjack_game".as_ref(), _game_id.to_le_bytes().as_ref()],
         bump = blackjack_game.bump,
+        constraint = blackjack_game.player_pubkey == payer.key() @ ErrorCode::NotAuthorized,
     )]
-    pub blackjack_game: Account<'info, BlackjackGame>,
+    pub blackjack_game: Box<Account<'info, BlackjackGame>>,
 }
 
 #[callback_accounts("player_hit")]
@@ -941,8 +925,9 @@ pub struct PlayerDoubleDown<'info> {
         mut,
         seeds = [b"blackjack_game".as_ref(), _game_id.to_le_bytes().as_ref()],
         bump = blackjack_game.bump,
+        constraint = blackjack_game.player_pubkey == payer.key() @ ErrorCode::NotAuthorized,
     )]
-    pub blackjack_game: Account<'info, BlackjackGame>,
+    pub blackjack_game: Box<Account<'info, BlackjackGame>>,
 }
 
 #[callback_accounts("player_double_down")]
@@ -1056,8 +1041,9 @@ pub struct PlayerStand<'info> {
         mut,
         seeds = [b"blackjack_game".as_ref(), _game_id.to_le_bytes().as_ref()],
         bump = blackjack_game.bump,
+        constraint = blackjack_game.player_pubkey == payer.key() @ ErrorCode::NotAuthorized,
     )]
-    pub blackjack_game: Account<'info, BlackjackGame>,
+    pub blackjack_game: Box<Account<'info, BlackjackGame>>,
 }
 
 #[callback_accounts("player_stand")]
@@ -1171,8 +1157,9 @@ pub struct DealerPlay<'info> {
         mut,
         seeds = [b"blackjack_game".as_ref(), _game_id.to_le_bytes().as_ref()],
         bump = blackjack_game.bump,
+        constraint = blackjack_game.player_pubkey == payer.key() @ ErrorCode::NotAuthorized,
     )]
-    pub blackjack_game: Account<'info, BlackjackGame>,
+    pub blackjack_game: Box<Account<'info, BlackjackGame>>,
 }
 
 #[callback_accounts("dealer_play")]
@@ -1286,8 +1273,9 @@ pub struct ResolveGame<'info> {
         mut,
         seeds = [b"blackjack_game".as_ref(), _game_id.to_le_bytes().as_ref()],
         bump = blackjack_game.bump,
+        constraint = blackjack_game.player_pubkey == payer.key() @ ErrorCode::NotAuthorized,
     )]
-    pub blackjack_game: Account<'info, BlackjackGame>,
+    pub blackjack_game: Box<Account<'info, BlackjackGame>>,
 }
 
 #[callback_accounts("resolve_game")]
@@ -1415,7 +1403,6 @@ pub struct PlayerDoubleDownEvent {
 
 #[event]
 pub struct PlayerStandEvent {
-    pub is_bust: bool,
     pub game_id: u64,
 }
 
@@ -1451,4 +1438,8 @@ pub enum ErrorCode {
     InvalidDealerClientPubkey,
     #[msg("Cluster not set")]
     ClusterNotSet,
+    #[msg("Not authorized to perform this action")]
+    NotAuthorized,
+    #[msg("Unexpected game result value from computation")]
+    InvalidGameResult,
 }