Rock Paper Scissors

Summary

The game state is not correctly updated after both commits are made and revealMove doesn't check the correct game state leading to unintended protocol behaviour where a user can accidentally reveal their move before their competitor has committed their move.

Vulnerability Details

commitMove() doesn't set the game state to Revealed after both players have made their commits. Additionally, revealMove is checking the game state to be equal to Committed instead of Revealed.

Impact

A player can accidentally reveal their solution before the other player has committed theirs which defeats the whole purpose of the commit-reveal scheme.

Tools Used

Recommendations

Set the game state to revealed at the end of the commitMove function where there is a check for both commits being made. In revealMove(), check that the game state is Revealed instead of Committed.