The revealMove
function should be allowed to be called only when both players commited their moves.
The revealMove
function does not check if both players committed a move, which is crucial for preventing certain scenarios. The attacker can see the revealMove
transaction in the mempool beforehand and change his/her move.
For example,
PlayerA and playerB join the game.
PlayerA makes a commit using commitMove
.
PlayerA reveals his move using revealMove
, without checking if both player committed a move.
The revealMove
function does not prevent 3. from happening, and reveals playerA's move in the mempool
PlayerB sees playerA's move in the mempool and takes advantage of the situation.
Although this problem could be prevented by carefully observing the system (and checking if both players committed a move before revealing your move), it is essential to check if both players committed a move inside the revealMove
function itself where the revealing phase actually starts to happen.
VSCode
Add a require statement inside revealMove
like the following,
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.