Summary ->

If player 1 uses weak salt '123', 'abc', Malicios user can brute-force their move off-chain once the commitment is published and prepare their 'winning' move in the next reveal cycle.

Vulnerability Details ->

• Player A submits a commitment with the hash of (Rock, "123").

• An attacker watching the chain can try all valid move values (Rock, Paper, Scissors) against a list of common salts to compute the hash.

• Once a match is found, the attacker knows Player A’s move and can submit a counter-move during the reveal phase, ensuring a win.

Impact -> Low / Minor

Tools Used -> Manual review

Recommendations ->

1. Use solidity bytes32 commit = keccak256(abi.encodePacked(move, _salt, msg.sender));

   This ensures that even if the salt is weak, the hash is only valid for the specific sender, making brute-forcing far less practical for other users.

2.Encourage users to use strong Random salt's.