Summary

Second player to call revealMove ends up paying for the gas to calculate the winner.

Vulnerability Details

revealMove calls _determineWinner if both moves were revealed. This means that the second player to call revealMove will pay for more gas.

Impact

This might disincentivize users to call this method and potentially causing the game to timeout.

Tools Used

Manual review

Recommendations

Something like CCIP automatization could be implemented to keep which games have been revealed by both users. In that case the winner can be determined already. This could be done for multiple games at the same time.
Another option could be to incentivize users to determine the winner by giving them small rewards at the end of the game.