remove app.js (not used), fix attack and be attacked logic