Submission Details
Severity:
Front-Running in Move Revealing inside the `RockPaperScissors::revealMove` function
Description: Players can see each other's revealed moves and potentially change their own move before the transaction is confirmed.
Impact: Players can cheat by waiting to see the opponent's move before revealing their own.
Proof of Concept:
// Attacker watches for opponent's reveal transaction
// Sees opponent revealed Rock
// Quickly submits their own transaction revealing Paper
Recommended Mitigation: Implement commit-reveal scheme with a time delay between commits and reveals.Implement commit-reveal scheme with a time delay between commits and reveals.
Rewards breakdown
nSLOC
349This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.