Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Lack of `timeOutCommit` function allows malicious player A to cause player B's funds and game to be stuck

37h3rn17y2

Summary

In RockPaperScissors contract, there is a lack of a timeoutCommit function. Malicious A can create a game and wait for player B to join. Then, player A refuses to commit a move. Since only the game creator (player A) can cancel the game, player B's funds are stuck and the game state is also stuck. There is no benefit for player A, this is just a griefing attack on player B.

Vulnerability Details

The following is the attack path

  1. Malicious player A creates game and wait for player B to join

  2. Player A refuses to commit a move

  3. Player B cannot cancel the game

PoC

Place the following into RockPaperScissorsTest.t.sol and run

forge test --mt testPlayerBCannotCancelGame

function testPlayerBCannotCancelGame() public {
// 1. Malicious player A creates game and wait for player B to join
uint256 _gameId = createAndJoinGame();
// 2. Player A refuses to commit a move
// 3. Player B cannot cancel the game
vm.prank(playerB);
vm.expectRevert();
game.cancelGame(_gameId);
}
​

Impact

Impact: High, player B funds are stuck, game is stuck
Likelihood: Low, no benefit to player A as player A's funds are stuck as well in this griefing attack
Severity: Medium

Tools Used

Manual review

Recommendations

Implement a timeoutCommit function to cancel the game after a timeout duration if either player does not commit a move.

Updates

Appeal created

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Player B cannot cancel a game if Player A becomes unresponsive after Player B joins

Protocol does not provide a way for Player B to exit a game and reclaim their stake if Player A stops participating

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Player B cannot cancel a game if Player A becomes unresponsive after Player B joins

Protocol does not provide a way for Player B to exit a game and reclaim their stake if Player A stops participating

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.