Rock Paper Scissors

Reentrancy Risk in ETH Prize Distribution

Summary

External ETH transfers in internal functions (_finishGame, _handleTie, _cancelGame) are vulnerable to reentrancy attacks.

Vulnerability Details

Location: ETH transfers via .call{value:}()

Issue:

State changes occur after external calls

Attackers could re-enter via malicious fallback functions

Impact

• Potential theft of locked ETH prizes

• Could manipulate game outcomes during reentry

Tools Used

Manual review

Recommendations

• Use pull-over-push pattern for withdrawals

• Implement OpenZeppelin’s ReentrancyGuard