Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Denial of Service in RockPaperScissors.sol

blurad

Summary

There's no timeout mechanism for commit phases after the initial turn

Vulnerability Details

The following code snippet shows how each move is commited

function commitMove(uint256 _gameId, bytes32 _commitHash) external {
Game storage game = games[_gameId];
​
require(msg.sender == game.playerA || msg.sender == game.playerB, "Not a player in this game");
require(game.state == GameState.Created || game.state == GameState.Committed, "Game not in commit phase");
​
if (game.currentTurn == 1 && game.commitA == bytes32(0) && game.commitB == bytes32(0)) {
// First turn, first commits
require(game.playerB != address(0), "Waiting for player B to join");
game.state = GameState.Committed;
} else {
// Later turns or second player committing
require(game.state == GameState.Committed, "Not in commit phase");
require(game.moveA == Move.None && game.moveB == Move.None, "Moves already committed for this turn");
}
​
if (msg.sender == game.playerA) {
require(game.commitA == bytes32(0), "Already committed");
game.commitA = _commitHash;
} else {
require(game.commitB == bytes32(0), "Already committed");
game.commitB = _commitHash;
}
​
emit MoveCommitted(_gameId, msg.sender, game.currentTurn);
​
// If both players have committed, set the reveal deadline
if (game.commitA != bytes32(0) && game.commitB != bytes32(0)) {
game.revealDeadline = block.timestamp + game.timeoutInterval;
}
}

Unlike the reveal phase which has timeoutReveal() to handle non-responsive players, here there's no such equivalent timeoutCommit() function or commit deadline, which with the lack of creates a permament lockup vector.

Impact

Permanent lock of both players' funds (ETH or tokens) in the contract with no recovery method

Tools Used

Manual code review

Recommendations

Add a commit phase timeout for each turn by introducing a commitDeadline variable in the Game struct

Set commitDeadline at the start of every commit phase

Implement a timeoutCommit function which allows the responsive player to claim victory/refund if the opponent fails to commit before the set deadline

Updates

Appeal created

m3dython Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game State Manipulation Preventing Opponent Commit

Attack allows a player to reveal their move for the next turn before the opponent commits

m3dython Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game State Manipulation Preventing Opponent Commit

Attack allows a player to reveal their move for the next turn before the opponent commits

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.