Rock Paper Scissors

Summary

The game does not update the state to GameState.Finished after the last turn in the _determineWinner() function. This could leave the game in a Committed state even though the game has concluded, potentially allowing inconsistent behavior or unintended interactions.

Vulnerability Details

In the RockPaperScissors contract, after the final move is revealed and the winner is determined in _determineWinner(), the game state is not explicitly updated to GameState.Finished. This results in the game potentially remaining in the Committed state even after all turns are completed.

Impact

The game remains in an incorrect state (Committed) even after completion.

• External or internal logic relying on the Finished state may behave incorrectly.

• Could enable replay or redundant commit/reveal attempts depending on future implementations.

• Potential implications for fee withdrawal, prize claiming, or cleanup mechanisms that depend on proper state transitions.

Tools Used

Foundry

POC:

}

Recommendations

Update the _determineWinner() function to explicitly set the game state to GameState.Finished once the final turn has been processed. For example:

if (game.currentTurn > game.totalTurns) {

// Finalize the game

game.state = GameState.Finished;

emit GameFinished(gameId, overallWinner, prize);

}