Rock Paper Scissors

Summary

In a turn, regardless of the hashed commit any player made first, the other player always has a strategy to never lose.

Vulnerability Details

The idea goes like this:

• First player (from here on denoted as X) commits first with hash value x.

• Second player (from here on denoted as Y) commits right afterwards with the same value x - since transactions are public, seeing first player's x is possible, and the process of sniffing x can be automated to nullify human latency.

• X reveals their choice first.

• Y reveals their choice similarly, as, again, X's revealing transaction is also public.

• Since X and Y's moves are completely identical, every turn would end in a draw.

• If X refuses to move first or reveal first, the game will be cancelled, thus it's also non-lose (though in fact that would be a small loss due to transaction fees).

Impact

The game is always stuck in a tying scenario with this exploit, or worse, negative sum game if considering fees.