Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Can't Start New Game If Old One Isn't Manually Ended

grands9n47

Summary

The startGame function lets the contract owner begin a new game by setting when it starts and ends, and by turning on the gameActive flag. It has a check that stops a new game from starting if one is already running. But this check only looks at the gameActive flag, which has to be turned off by calling the endGame function. If the owner doesn’t call endGame, and the game time has already finished, the game still stays locked. This means no new game can start, even though the old one is over.

Vulnerability Details

The vulnerability is that the game only checks a simple active flag without verifying if the game’s time has actually ended. This means if the owner fails to manually end the game, it remains locked even after its scheduled end, preventing any new game from starting. Essentially, the system becomes stuck, creating a "soft-lock" that renders the contract unusable until the owner intervenes.

Impact

function startGame(uint256 duration) external onlyOwner {
require(!gameActive, "Game already active");
require(duration >= MIN_GAME_DURATION, "Duration too short");
startTime = block.timestamp;
endTime = block.timestamp + duration;
gameActive = true;
emit GameStarted(startTime, endTime);
}
​

Tools Used

manual review

Recommendations

Add a utility function to check game status more accurately:

function isGameActive() public view returns (bool) {
return gameActive && block.timestamp < endTime;
}
​

Auto-expire the game based on time:

require(!gameActive || block.timestamp >= endTime, "Game already active");
​
Updates

Lead Judging Commences

m3dython Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Incomplete end game handling

Incorrect values reported when a game is ended early

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.