Rock Paper Scissors
First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing Commit-Phase Timeout Allows Permanent Fund Locking

eightysix

Summary

The commit phase lacks a timeout mechanism, allowing malicious/absent players to permanently lock opponents' funds by never completing their commitment.

Vulnerability Details

Code Flaw:

  • timeoutReveal only handles reveal-phase timeouts

  • No deadline enforcement for players to complete commit

  • revealDeadline never set if both commits aren't received

Attack Scenario:

  1. Player A creates game but never commits

  2. Player B joins and commits

  3. Game remains stuck in Committed state indefinitely

  4. Funds permanently locked in contract

Impact

Permanent loss of ETH/tokens for honest players

Tools Used

  • Manual Review

    Foundry test

Recommendations

Add Commit Deadlines

Updates

Appeal created

m3dython Lead Judge 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Player B cannot cancel a game if Player A becomes unresponsive after Player B joins

Protocol does not provide a way for Player B to exit a game and reclaim their stake if Player A stops participating

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.