Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

[H-04] Game State Residual Persistence Vulnerability

0xshaedyw

Summary

The _finishGame() and _handleTie() functions fail to fully reset critical game state variables, allowing residual player scores and commitments to persist after game resolution. This compromises fairness in subsequent games involving the same players.

Vulnerability Details

Affected Functions

  • RockPaperScissors:_finishGame()

  • RockPaperScissors:_handleTie()

Root Cause Analysis

The state reset logic in _determineWinner() only partially clears game data:

if (game.currentTurn < game.totalTurns) {
// Partial reset for ongoing games
game.commitA = bytes32(0);
game.commitB = bytes32(0);
game.moveA = Move.None;
game.moveB = Move.None;
} else {
// No reset when game ends (finishGame/handleTie)
_finishGame(_gameId, winner);
}

Attack Flow

  1. Game 1: Patrick wins 2-1

    • scoreA = 2 persists in storage

  2. Game 2: New game starts

    • Inherits residual scoreA value

  3. Result: Patrick begins Game 2 with 2-0 advantage

Impact

  • Unearned advantage in subsequent games

  • Score inflation exploits

Tools Used

  • Manual Code Review

Recommendations

  • Immediate Fix

function _resetGameState(uint256 _gameId) private {
Game storage game = games[_gameId];
game.scoreA = 0;
game.scoreB = 0;
game.commitA = bytes32(0);
game.commitB = bytes32(0);
game.moveA = Move.None;
game.moveB = Move.None;
// Preserve archival states:
// - playerA/B
// - bet amount
// - totalTurns
}

  • Call _resetGameState() in both:

function _finishGame() {
_resetGameState(_gameId);
// ... prize distribution ...
}
​
function _handleTie() {
_resetGameState(_gameId);
// ... refund logic ...
}
Updates

Appeal created

m3dython Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
m3dython Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.