Summary

• An attacker can force a game cancellation immediately after the first commit, without the opponent ever committing or revealing.

• Severity: Medium

• Required: Any participating player

• Likelihood: High

Vulnerability Details

On the very first commit (either player A or B), the contract sets

• At this point, game.revealDeadline is still its default of 0, since it only gets set after both commits are received.

  timeoutReveal(_gameId)

• passes the check

  require(block.timestamp > game.revealDeadline, "Reveal phase not timed out yet");

• immediately, because block.timestamp > 0.

• Since neither move has been revealed, the contract treats it as a double forfeit and calls _cancelGame(), refunding both sides and ending the game.

Impact

• A player can launch a cheap Denial-of-Service, cancelling games at will.

• Frustrates legitimate players and undermines trust in the platform.

Tools Used

• Manual code review

Recommendations

• When the first commit arrives, set game.revealDeadline = block.timestamp + game.timeoutInterval; immediately.