You have access to params and current_user in private methods, so you can call it directly there and remove it from params. Just make it work as update_vote(1) and update_vote(-1).

Also, I have just noticed a problem here. If user is not logged in, he might not even know it's possible to leave a vote. We should leave some information like "Sign in to leave a comment".

Also, params[:game_id] might not even work. You need to sanitize it like this:

params.require(:game_id). You can read about strong params here: http://edgeguides.rubyonrails.org/action_controller_overview.html#strong-parameters