Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Denial-of-Service via premature `timeoutReveal`

jufel

Description: On the first commit (e.g. Player A calls commitMove), the contract sets 'state = Committed' but does not yet set 'revealDeadline' (it remains zero). Immediately afterward, any player can call timeoutReveal, since 'block.timestamp > 0' is always true, and neither side "revealed", the contract calls _cancelGame, aborting the match and refunding both.

Impact: Either player can grief the other by committing first and then cancelling before the opponent even commits. No one loses ETH, but the opponent is forced out of the game.

Recommended Mitigation: Only allow timeoutReveal after both commits:

function timeoutReveal(uint256 _gameId) external {
Game storage game = games[_gameId];
+ require(game.revealDeadline != 0);
}
Updates

Appeal created

m3dython Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational

Code suggestions or observations that do not pose a direct security risk.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.