My First Competitive Audit Experience: Insights from First Flight

Participating in my first, First Flight audit was a significant milestone in my journey as a smart contract auditor.

First Flight, a non-paid, competitive audit event, provided a unique opportunity to test my skills. As someone relatively new to competitive auditing, the experience was a combination of both vulnerability detection and strategic thinking. In this article, I will delve into the vulnerabilities I identified, including those validated by the First Flight team, and also analyze some notable findings from other participants.

Overview of First Flight

First Flight operates as a competitive, time-limited audit event where auditors are given access to a set of smart contracts and tasked with identifying potential vulnerabilities. Points are awarded based on the severity and validity of reported issues, with the ultimate goal of refining both detection skills and reporting techniques.

Stepping Into the Arena

When I signed up for First Flight, I knew it would be intense. The environment creates a sense of urgency as you race against time to identify vulnerabilities before the submission deadline. I spent hours poring over smart contract code, dissecting logic flows, and setting up attack scenarios. The focus wasn’t just on finding issues but on accurately assessing their severity and articulating the potential impact clearly in the reports.

About the Contest (Rock Paper Scissors)

The Rock Paper Scissors DApp is a decentralized game on Ethereum that enables players to wager in ETH or special Winner Tokens. It employs a commit-reveal mechanism to ensure fair play and prevent cheating. Key features include support for multiple-turn matches with best-of-N scoring, automatic prize distribution, and timeout protection against non-responsive players. The smart contract uses the commit-reveal pattern to prevent frontrunning and secure player moves until both parties have committed. You can find more about the contest here

My Discoveries: One High, One Medium

My high finding was the identification of timeout exploitation and griefing vulnerabilities in the Rock Paper Scissors DApp, highlighting how unchecked timeout handling and lack of player penalties can be exploited to disrupt gameplay and reduce protocol fairness. A malicious player can intentionally withhold a move reveal, forcing the game to time out and resulting in a refund, allowing the malicious player to avoid potential losses while wasting the honest player’s time and gas fees. Additionally, a player can observe their opponent’s revealed move and decide whether to reveal their own move or let the game time out, introducing a strategic advantage to the second revealer and undermining fair play. Also, malicious actors can initiate multiple games, refuse to complete them, and congest the contract with unresolved matches, effectively denying service to other players. To mitigate these vulnerabilities, implementing timeout penalties through escalating deductions, enforcing timely reveals with bond requirements, limiting concurrent games per player, tracking player reputation to penalize repeat offenders, and rewarding honest players for timely play and consistent participation are essential steps to maintain fair gameplay and protocol integrity.

My medium-severity finding in the RockPaperScissors smart contract was the lack of validation for commit hashes in the commitMove function, allowing players to submit zero or trivial values that can be easily predicted, undermining the security of the commit-reveal scheme; the vulnerability stemmed from the absence of entropy checks in the _commitHash parameter, enabling attackers to use predictable hashes and manipulate game outcomes based on their opponent’s move, as demonstrated in a test scenario where an attacker committed a trivial hash (bytes32(uint256(1))), compromising game integrity and potentially leading to fund loss for honest players; to mitigate this, implementing minimum entropy requirements for commit hashes, adding commit hash validation through entropy checks, and rejecting trivial values like 0x0 or low-entropy hashes are recommended measures, along with emphasizing the importance of secure salts and complex values to prevent predictability in hash-based schemes.

Summary of all findings in the contest

The audit of the Rock Paper Scissors DApp revealed multiple vulnerabilities that compromised the fairness, security, and integrity of the game. High-severity findings included the ability to overwrite playerB addresses, enabling malicious actors to manipulate game participation and steal funds; denial of service (DoS) through ETH transfer reverts, allowing attackers to block game resolution by rejecting ETH transfers; and reveal manipulation, permitting attackers to exploit turn sequences to force timeouts and win games unfairly. Medium-severity findings involved fund locking through unwithdrawable ETH, allowing malicious players to prevent game conclusion after winning the majority of turns, and lack of player address binding in commit-reveal, facilitating replay attacks and unauthorized move revelations. Low-severity findings identified issues such as token accumulation due to improper burning, ETH rounding errors in tie handling, and potential game cancellation before the reveal deadline due to uninitialized values.

Key Takeaways and Next Steps

My first First Flight audit was a valuable experience in identifying and reporting smart contract vulnerabilities in a competitive, time-sensitive environment. While achieving 120 points and successfully validating two vulnerabilities is a solid start, the exercise also highlighted areas for further improvement, particularly in analyzing more complex attack vectors and optimizing reporting clarity.

Moving forward, I plan to refine my vulnerability detection techniques, participate in more competitive audits, and continue studying advanced smart contract attack patterns. Additionally, I aim to deepen my understanding of best practices in security architecture and leverage tools like Tenderly for ongoing monitoring and alerting.

Stay tuned for more insights and lessons from upcoming audits and security challenges.

Thank youuuuu