Rock Paper Scissors

Summary

The RockPaperScissors game contract contains a vulnerability in the revealMove() function. The function allows a player to reveal their move without verifying that both players have committed their moves first. This creates a front-running opportunity where an opponent can observe the revealed move and then commit a winning counter-move. Even more concerning, an attacker can fake a move commitment by submitting an empty 32 bytes hash (bytes32(0)) which emits an event, tricking the first player into revealing their move prematurely.

Vulnerability Details

The revealMove() function does not validate that both players have submitted valid commitments before allowing the move revelation. While the function checks that the game state is Committed, it does not ensure that both commitA and commitB contain valid (non-zero) commitments.

A malicious player can exploit this by waiting for the opponent to reveal first, then commit a winning counter-move.

Proof of Concept:

Impact

• It undermines the fairness of the game.

• Impact is limited though by honest player to make sure not to prematurely reveal move even when event is emitted (since it might be fake).

Tools Used

• Foundry

Recommendations

• Modify the revealMove() function to check that both commitments are valid (non-zero) before allowing any revealing the moves.

• If player goes on to reveal their move without the other player committing theirs, the turn should be invalidated.