Rock Paper Scissors

Summary

The timeoutReveal function can be called before the second commit is made

Vulnerability Details

In commitMove(), the game.revealDeadline is only set once both players have made their commits. Until then, the revealDeadline is unset and either player can call timeoutReveal, causing the game to cancel.

Impact

Any malicious user can join a game where the game creator has not yet made a commit, make a commit, and call timeoutReveal to cancel the game.

Tools Used

N/A

Recommendations

Set revealDeadline during the game creation to be a default time far into the future which prevent a pre-emptive call to timeoutReveal. The revealDealine will get reset to the correct value once both commits are made.