Rock Paper Scissors

Summary

If the same _commitHash is reused in multiple games, a player could replay a previous commitment.
Player commits once, joins other games and claims wins if outcomes are favorable.The _commitHash
(e.g. keccak256(abi.encodePacked(move, salt))) can be reused across games or turns if not bound to the game context.

Vulnerability Details

Player A creates or joins several games.

Player A precomputes and submits a valid _commitHash (e.g., for Rock).

Waits to see the outcomes of games or other players' moves.

Selectively reveals the move in games where it guarantees a win.

Abandons or lets timeout games where the move would lose.

Impact

Players may reuse or brute-force commitments, reducing fairness or enabling precomputed attacks.

Tools Used

Manual code review.

Recommendations

Include gameId, currentTurn, and salt in hash: keccak256(abi.encodePacked(move, salt, gameId, turn)).