Timeout Reveal Exploitation (Griefing Attack)

Summary:

If one player commits but refuses to reveal their move, the other player can use the timeoutReveal() function after the timeout expires to claim a win unfairly. This enables griefing attacks where a dishonest player manipulates the game outcome.

Vulnerability Details:
The timeoutReveal() function allows the first player who calls it to claim victory if the other player hasn't revealed. Since there is no penalty or refund for the honest player who revealed, malicious actors can exploit this to win by simply refusing to reveal their own moves.

Code Snippet:

Impact:
Dishonest players can intentionally avoid revealing, leading to unfair wins, player frustration, and undermining trust in the platform.

Tools Used:

• Solidity

• VS Code

Recommendations:
Introduce penalties for players who don't reveal (e.g., partial refund to the honest player).
Alternatively, split the staked bet between both players if neither reveals.