Rock Paper Scissors

🔎 Centralization Risks vs. Decentralization Claims in RockPaperScissors DApp

📊 Summary

The RockPaperScissors DApp advertises itself as a "fully decentralized implementation" of the classic Rock-Paper-Scissors game on Ethereum. However, upon reviewing the actual implementation and its security structure, multiple design elements contradict this decentralization claim, introducing centralization risks that should be acknowledged and addressed.

🔎 Observed Claim

"Rock Paper Scissors DApp is a fully decentralized implementation of the classic Rock Paper Scissors game on Ethereum."

⚠️ Technical Findings That Contradict This Claim

1. Ownable Usage in WinningToken.sol Contract

• The WinningToken.sol contract inherits from OpenZeppelin's Ownable, and the mint() function is restricted via onlyOwner.

• This means that the entity which deployed the contract (typically the RockPaperScissors.sol contract or its deployer) retains full minting control.

• This introduces a central point of control that contradicts decentralization.

2. setAdmin() Function in RockPaperScissors.sol

• Allows the current admin (owner) to change the adminAddress arbitrarily.

• No on-chain governance or access control layers (e.g., multi-sig or timelock).

• A malicious or compromised admin could assign themselves or another address and steal accumulated protocol fees or interfere with game settings.

• This was verified and demonstrated through a valid Proof-of-Concept exploit.

3. No Use of On-Chain Governance or Decentralized Access Control

• Contracts lack role-based permissioning via AccessControl.

• No usage of DAOs, community voting, or multisig wallets.

• Critical protocol-level actions (minting tokens, withdrawing fees, changing admin) are fully centralized.

🔧 Real-World Impact of Centralization

• Trust dependency: Users must blindly trust that the deployer/admin will not abuse privileges.

• Token issuance risk: Unlimited minting of WinningToken is possible if owner privileges are abused.

• Fee control risk: Protocol fees held on contract can be redirected to an attacker via admin key compromise.

🔍 Recommendations

To align the implementation with the decentralization claim:

1. ⛏ Remove Ownable from WinningToken.sol or replace with AccessControl and restrict mint() to RockPaperScissors.sol only.

2. 🔐 Harden admin management in RockPaperScissors.sol:

   • Introduce a multi-signature wallet (e.g., Gnosis Safe)

   • Or replace setAdmin() with time-locked governance proposals.

3. ⚖️ Introduce max supply for WinningToken.sol to mitigate infinite inflation.

4. 🫠 Document all centralized points clearly if temporary or introduce transition plans to decentralize.

📄 Conclusion

While the game logic and user flow are decentralized in spirit, the underlying administrative and token mechanics introduce central points of failure. This undermines the protocol’s claim of being "fully decentralized" and should be addressed transparently for users and security auditors alike.

📄 Tool Used

Aderyn - Solidity Security Extension