Rock Paper Scissors

Summary

The revealMove function should be allowed to be called only when both players commited their moves.

Vulnerability Details

The revealMove function does not check if both players committed a move, which is crucial for preventing certain scenarios. The attacker can see the revealMove transaction in the mempool beforehand and change his/her move.

For example,

1. PlayerA and playerB join the game.

2. PlayerA makes a commit using commitMove.

3. PlayerA reveals his move using revealMove, without checking if both player committed a move.

4. The revealMove function does not prevent 3. from happening, and reveals playerA's move in the mempool

5. PlayerB sees playerA's move in the mempool and takes advantage of the situation.

Impact

Although this problem could be prevented by carefully observing the system (and checking if both players committed a move before revealing your move), it is essential to check if both players committed a move inside the revealMove function itself where the revealing phase actually starts to happen.

Tools Used

VSCode

Recommendations

Add a require statement inside revealMove like the following,