# Splatoon 3 In-Match Integrity Bypass via Consensus Reflection Attack on Unordered Peer Submission

Splatoon 3 anticheat let consoles submit integrity hashes in any order, so a modded console copied a peer's legitimate hashes to hide tampered code.

- Payout: hidden
- Severity: high
- Program: Nintendo
- Found by: liz403
- Disclosed: 2026-07-02
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/3559522
- Library page: https://bugbountylibrary.com/r/h1%3A3559522
- Tags: area:devices domain:network impact:integrity kind:bounty platform:hackerone sev:high tech:websocket technique:reverse-engineering technique:source-review vuln:auth-bypass vuln:business-logic

**Target:** Nintendo Switch game anticheat integrity-hash exchange protocol
**Root cause:** Consoles exchanged integrity hashes on a timer with no enforced ordering or commitment, so a peer's submission was visible before an attacker had to submit their own. Hashes were not bound to player-specific data.
**Steps:**
1. Hook the anticheat data receiver on a modified console.
2. Capture incoming integrity packets; filter for packets from the same console type (Switch 1/2).
3. When the local submission timer fires, send the captured peer's hashes instead of locally computed hashes.
4. Other clients and replay data accept the modified console as legitimate, hiding tampered game code.
**How found:** Observation that hash exchange was timer-based with no enforced ordering and all consoles were expected to submit identical data, implying a window where a peer's submission is visible before the attacker must submit.
**Exploitation:** Attacker runs modified game code, hooks the anticheat receiver, records a same-console-type peer's integrity hash packet, and replays it as their own submission each turn, so no dirty hashes ever appear to peers or in replays.
**Insight:** When a consensus/integrity protocol expects all parties to submit identical values, check whether submission order is enforced; if a peer's value is observable before you must commit, you can reflect it. Fix pattern is commit-reveal bound to identity.