Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing check for timeoutInterval & revealDeadline in joinGameWithEth() __RockPaperScissors.sol

hawks

Summary

The joinGameWithEth function is missing a check to ensure that timeoutInterval is less than or equal to revealDeadline.

Vulnerability Details

If the contract don’t check whether timeoutInterval <= revealDeadline, the game logic can become inconsistent or exploitable.

A malicious player could set a very short revealDeadline with a long timeoutInterval, making it impossible for the opponent to reveal their move in time.
This could result in unfair timeouts or denial of fair gameplay.

function joinGameWithEth(uint256 _gameId) external payable {
Game storage game = games[_gameId];
require(game.state == GameState.Created, "Game not open to join");
require(game.playerA != msg.sender, "Cannot join your own game");
require(block.timestamp <= game.joinDeadline, "Join deadline passed");
game.playerB = msg.sender;
emit PlayerJoined(_gameId, msg.sender);
}
​

Impact

Player may be unfairly timed out

Opponent may be unable to complete the reveal phase

Tools Used

Manual review

Recommendations

Add a validation to ensure that timeoutInterval does not exceed revealDeadline

Fixed code:

function joinGameWithEth(uint256 _gameId) external payable {
Game storage game = games[_gameId];
require(game.timeoutInterval <= game.revealDeadline, "Timeout exceeds reveal deadline");
require(game.state == GameState.Created, "Game not open to join");
require(game.playerA != msg.sender, "Cannot join your own game");
require(block.timestamp <= game.joinDeadline, "Join deadline passed");
game.playerB = msg.sender;
emit PlayerJoined(_gameId, msg.sender);
}
​
Updates

Appeal created

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
m3dython Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.