#933 SC-24: Validate player addresses are not identical in create_tournament_escrow

[ZeePearl56]

Summary

Closes #933

Adds a validation check in create_tournament_escrow to prevent a player from creating a tournament escrow against themselves. Without this check, a user could create a game where player1 == player2, potentially gaming ELO mechanics or exploiting edge cases in payout rounding.

Changes

File: contracts/game_contract/src/lib.rs — create_tournament_escrow function

Added the following check immediately after verifying the game state is Completed and before the authorization check:

// Prevent a player from creating a tournament escrow against themselves (#933)
if let Some(ref player2) = game.player2 {
    if game.player1 == *player2 {
        return Err(ContractError::AlreadyJoined);
    }
}

Rationale

• Reuses existing error: ContractError::AlreadyJoined (value 6) already existed and is semantically appropriate — it is the same error returned by join_game when player1 == player2.
• Consistent placement: The check runs before require_auth(), following the fail-fast pattern used elsewhere in the contract. This avoids prompting for authorization on a request that will be rejected.
• Edge cases handled: The if let Some(ref player2) pattern correctly handles games where player2 is None (single-player games), where address equality is not a concern.

Acceptance Criteria

• Add a require!(player1 != player2) check during escrow and game creation
• All 65 existing contract tests pass
• Consistent with existing checks in join_game

Testing

All 65 existing tests pass with zero failures after the change:

test result: ok. 65 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out

[drips-wave]

@ZeePearl56 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits