fix(game): patch Desync DoS vulnerability with strict majority consensus (#3956)
Resolves #3959 ## Description: This PR fixes a Denial of Service (DoS) vulnerability in 1v1 matches related to desync reporting. The `findOutOfSyncClients` logic previously forced a game-ending desync if half or more players reported conflicting hashes (`outOfSyncClients.length >= Math.floor(this.activeClients.length / 2)`). In a 1v1, this meant a single malicious player sending a bad hash could trigger a global desync, crashing their opponent's game session. The logic has been corrected to require a **strict majority** (`> Math.floor(this.activeClients.length / 2)`) to declare a lobby-wide desync. In a 1v1 game, a single malicious actor will now simply be flagged as the out-of-sync client and disconnected, allowing the honest player to continue their session uninterrupted. ## Please complete the following: - [X] I have added screenshots for all UI updates - [X] I process any text displayed to the user through translateText() and I've added it to the en.json file - [X] I have added relevant tests to the test directory - [X] I confirm I have thoroughly tested these changes and take full responsibility for any bugs introduced ## Please put your Discord username so you can be contacted if a bug or regression is found: barfires Co-authored-by: Josh Harris <josh@wickedsick.com>
B
Berk committed
ddf63066faa15a71e296984f1901f4cce7bbfb84
Parent: 1721131
Committed by GitHub <noreply@github.com>
on 5/27/2026, 2:10:43 PM