fix(game): patch Desync DoS vulnerability with strict majority consensus (#3956)

Resolves #3959

## Description:

This PR fixes a Denial of Service (DoS) vulnerability in 1v1 matches
related to desync reporting. The `findOutOfSyncClients` logic previously
forced a game-ending desync if half or more players reported conflicting
hashes (`outOfSyncClients.length >= Math.floor(this.activeClients.length
/ 2)`). In a 1v1, this meant a single malicious player sending a bad
hash could trigger a global desync, crashing their opponent's game
session.

The logic has been corrected to require a **strict majority** (`>
Math.floor(this.activeClients.length / 2)`) to declare a lobby-wide
desync. In a 1v1 game, a single malicious actor will now simply be
flagged as the out-of-sync client and disconnected, allowing the honest
player to continue their session uninterrupted.

## Please complete the following:

- [X] I have added screenshots for all UI updates
- [X] I process any text displayed to the user through translateText()
and I've added it to the en.json file
- [X] I have added relevant tests to the test directory
- [X] I confirm I have thoroughly tested these changes and take full
responsibility for any bugs introduced

## Please put your Discord username so you can be contacted if a bug or
regression is found:

barfires

Co-authored-by: Josh Harris <josh@wickedsick.com>
This commit is contained in:
Berk
2026-05-27 17:10:43 +03:00
committed by GitHub
parent 172113193f
commit ddf63066fa
+2 -2
View File
@@ -1223,8 +1223,8 @@ export class GameServer {
}
}
// If half clients out of sync assume all are out of sync.
if (outOfSyncClients.length >= Math.floor(this.activeClients.length / 2)) {
// If strict majority clients out of sync assume all are out of sync.
if (outOfSyncClients.length > Math.floor(this.activeClients.length / 2)) {
outOfSyncClients = this.activeClients;
}