Summary

It is expected that the user provides the commit generated by a salt, but there is not validation that the salt is complex enough.

Vulnerability Details

It is expected that the commit have the following format keccak256(abi.encodePacked(uint8(Move), salt)). If the salt used by the user is very weak, then the other player could try to guess the commit with brute force.

Impact

Players could use brute force to try to guess the commit hash of the move

Tools Used

Manual review

Recommendations

It would be tricky to validate the salt complexity inside the contract, but the app could provide different ways to minimize this, either with more documentation or with a client library that helps users with the generation of the hash