Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Admin Can End Game Before Endtime is Reached

damboy

Summary

In the EggHuntGameThere are variables startTime and endTime which is set by the admin and defines the time range for the egg hunt game to be active. These are intended to provide boundaries within which players can find eggs.

However, the contract allows the admin to call endGame() and terminate the game before the endTime deadline is reached, regardless of whether the players still have valid time left. This may undermine the trust and expectations of participants who rely on the inputted end time.

Vulnerability Details

The endGame() function lacks a check to ensure that the current block timestamp has passed the endTime:

function endGame() external onlyOwner {
require(gameActive, "Game is not active");
gameActive = false;
emit GameEnded(block.timestamp);
}
​

This allows the owner to end the game before the scheduled endTimeeven if the game is actively running.

This logic can cause confusion, unexpected outcomes for players and may be viewed as unfair, especially in a competitive game where timing is crucial or where rewards are distributed based on player activity within the designated period.

Proof of concept (POC)

​
function testAdminCanEndGameBeforeEndtime() public {
vm.prank(owner);
game.startGame(100);
// Fast-forward time by 30 seconds
vm.warp(block.timestamp + 30);
​
assertTrue(block.timestamp < game.endTime());
// Admin ends the game before the endTime
vm.prank(owner);
game.endGame();
​
// Validate that the game is no longer active
assertFalse(game.gameActive());
​
string memory status = game.getGameStatus();
assertEq(status, "Game is not active");
}
​

Impact

  • Unfair Termination: Players expect the game to run until endTime might miss out on opportunities if the game ends early.

  • Trust Issues: Participants might lose trust in the fairness of the game if the admin can prematurely cut it short.

  • Inconsistency: The presence of endTime implies a commitment to a time window, but that commitment is unenforced.

Tools Used

  • Manual review

  • Foundry

Recommendations

  1. Enforce endTime in endGame() Logic

Add a requirement to ensure the game cannot be ended before the official time:

function endGame() external onlyOwner {
require(block.timestamp >= endTime, "Cannot end game before endTime");//<==Here
require(gameActive, "Game is not active");
gameActive = false;
emit GameEnded(block.timestamp);
}
​

This allows the game to only end when the end time is reached

Updates

Lead Judging Commences

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Trusted Owner

Owner is trusted and is not expected to interact in ways that would compromise security

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.