Submission Details
Severity:
User can play `None` move lead to permanatly lock the another user funds or tokens in the game or contract.
Description
There is `None` move in `Move` struct in the game contract to determint complation of the turn. One malicoisly can create the game and after the player has joined they can make `None` move, Which lead to unmatch hash while revealing the move. Results in permanently lock the users funds in the contract.
Impact
The user will loss their money due to permanently locked in the contract.
Proof of Concept
```javascript
function testPlayersCanMakeNoneMove() public {
gameId = createAndJoinGame();
// Player A commits
bytes32 saltA = keccak256(abi.encodePacked("salt for player A"));
bytes32 commitA = keccak256(abi.encodePacked(uint8(RockPaperScissors.Move.None), saltA));
vm.prank(playerA);
vm.expectEmit(true, true, false, true);
emit MoveCommitted(gameId, playerA, 1);
game.commitMove(gameId, commitA);
// Player B commits
bytes32 saltB = keccak256(abi.encodePacked("salt for player B"));
bytes32 commitB = keccak256(abi.encodePacked(uint8(RockPaperScissors.Move.Paper), saltB));
vm.prank(playerB);
vm.expectEmit(true, true, false, true);
emit MoveCommitted(gameId, playerB, 1);
game.commitMove(gameId, commitB);
// Verify game state
(,,,,,,,,, bytes32 storedCommitA, bytes32 storedCommitB,,,,, RockPaperScissors.GameState state) =
game.games(gameId);
assertEq(storedCommitA, commitA);
assertEq(storedCommitB, commitB);
assertEq(uint256(state), uint256(RockPaperScissors.GameState.Committed));
// vm.warp(1 minutes);
// vm.prank(playerA);
// vm.expectRevert();
// game.revealMove(gameId, 1, saltA);
}
```
Recommendations
The protocol should implement the mechanism that only allow user to make moves like rock, paper, scissors. None move can lead to stuck the game.
Updates
Rewards breakdown
nSLOC
349This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.