Rock Paper Scissors

Summary

Players can see each other's commit transactions in the mempool

A malicious player could wait to see the opponent's commit before submitting their own

Vulnerability Details

because games mapping are public any opposing player can search for the round ID to see their opponent's moves from the struct and defeat them

Impact

the whole purpose of the game is destroyed because it is always the one who wins the opponent's move

Tools Used

Manual review

Recommendations

game mapping should not be public