Rock Paper Scissors

Summary

The revealMove function calls _finishGame, which transfers ETH via .call before finalizing the game state, allowing reentrancy. Without ReentrancyGuard, a malicious winner contract could disrupt execution or manipulate state, violating best practices.

Vulnerability Details

The revealMove function, callable externally, processes a player’s move and, on the final turn (currentTurn == totalTurns), calls the internal _finishGame function. _finishGame transfers ETH to the winner using a low-level. `.call`:

Impact

• Potential disruption of game finalization if a malicious winner contract reenters and triggers unintended logic before game.state is set to Finished.

• Possible state manipulation if other external functions lack proper GameState checks, allowing reentrant calls to alter contract behavior.

• Increased audit complexity due to non-standard reentrancy protection, reducing developer trust.

• No confirmed fund theft, but the risk of logic errors or gas consumption justifies Medium severity (could be High with a proven exploit).

Tools Used

Slither, Aderyn

Recommendations

Add OpenZeppelin’s ReentrancyGuard to revealMove and other external functions calling _finishGame (e.g., settleGame, if present) to prevent reentrancy. Optionally, move the state change (game.state = GameState.Finished) before the .call in _finishGame for additional safety.