Rock Paper Scissors

First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Severity: medium
Invalid

`revealMove` function does not check if both players committed a move, making it possible for the attacker to change his moves

Summary

The revealMove function should be allowed to be called only when both players commited their moves.

Vulnerability Details

The revealMove function does not check if both players committed a move, which is crucial for preventing certain scenarios. The attacker can see the revealMove transaction in the mempool beforehand and change his/her move.

For example,

  1. PlayerA and playerB join the game.

  2. PlayerA makes a commit using commitMove.

  3. PlayerA reveals his move using revealMove, without checking if both player committed a move.

  4. The revealMove function does not prevent 3. from happening, and reveals playerA's move in the mempool

  5. PlayerB sees playerA's move in the mempool and takes advantage of the situation.

Impact

Although this problem could be prevented by carefully observing the system (and checking if both players committed a move before revealing your move), it is essential to check if both players committed a move inside the revealMove function itself where the revealing phase actually starts to happen.

Tools Used

VSCode

Recommendations

Add a require statement inside revealMove like the following,

function revealMove(uint256 _gameId, uint8 _move, bytes32 _salt) external {
Game storage game = games[_gameId];
+ require(game.commitA != bytes32(0) && game.commitB != bytes32(0), "Both players must commit first");
require(msg.sender == game.playerA || msg.sender == game.playerB, "Not a player in this game");
require(game.state == GameState.Committed, "Game not in reveal phase");
require(block.timestamp <= game.revealDeadline, "Reveal phase timed out");
require(_move >= 1 && _move <= 3, "Invalid move");
Updates

Appeal created

m3dython Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
m3dython Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.