search

elazarg / solidity

0 stars 0 forks source link

Commitment vulnerability #2

Closed elazarg closed 7 years ago

elazarg commented 7 years ago

The second player can easily cheat if he is even or wants draw in RSP: simply send the same token as the first one. This means he has the same number, so he can reveal this number after the first player reveals her.

I am not entirely sure how it should be fixed, but disallowing the second player to have the same number as the first sounds reasonable, although it allows a very weak (and potentially costly) DOS by "replaying" the number sent to the token before they arrive, hoping to get there first.

elazarg commented 7 years ago

Another possibility is salting with msg.sender