Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Player B Assignment Check Leads Game Hijacking and Frontrunning Attacks

nhippolyt

Summary

The RockPaperScissors::joinGameWithEth and RockPaperScissors::joinGameWithToken functions lack a critical check to verify whether playerB has already been assigned to a game. Attackers can exploit this oversight to overwrite the existing playerB address, enabling game hijacking and frontrunning attacks. This vulnerability violates the core two-player design of the protocol and compromises game integrity.

Vulnerability Details

Affected Code

// In joinGameWithEthfunction joinGameWithEth(uint256 _gameId) external payable {// ...game.playerB = msg.sender; // No check for existing playerB}
// In joinGameWithTokenfunction joinGameWithToken(uint256 _gameId) external {// ...game.playerB = msg.sender; // No check for existing playerB}

The functions directly assign msg.sender to playerB without confirming that the slot is unoccupied. This allows any address to overwrite playerB even after a legitimate player has joined the game.

Attack Scenarios
Player Hijacking:

A legitimate player (player) joins a game.

An attacker calls RockPaperScissors::joinGameWithEth/joinGameWithToken for the same gameId, replacing playerB with their own address.

Frontrunning:

A legitimate player submits a joinGame transaction.

An attacker monitors the mempool, frontruns the transaction, and replaces playerB with their own address.

Impact

  • Game Integrity: Legitimate players are excluded from games they intended to join.

  • Trust in Protocol: Users lose confidence as attackers can arbitrarily hijack games.

Tools Used

Recommendations

Add a check to ensure playerB is unassigned before allowing a player to join:

// In both functions:
require(game.playerB == address(0), "Game already has a second player");
game.playerB = msg.sender;
Updates

Appeal created

m3dython Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Absence of State Change on Join Allows Player B Hijacking

Game state remains Created after a player joins

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.