Submission Details
Severity:
Front-Running in Game Joining
Description: The RockPaperScissors::joinGameWithEth() and RockPaperScissors::joinGameWithToken() functions are vulnerable to front-running attacks where an attacker could monitor the mempool and join games before legitimate players.
Impact: Malicious actors could consistently join games, potentially disrupting the game flow and fairness.
Proof of Concept:
function joinGameWithEth(uint256 _gameId) external payable {
// ... existing code ...
game.playerB = msg.sender;
emit PlayerJoined(_gameId, msg.sender);
}
Recommended Mitigation: Implement a commit-reveal scheme for joining games or use a whitelist system.
Rewards breakdown
nSLOC
349This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.