Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Premature Game Termination Vulnerability

elyas6126

Summary

The endGame function allows the contract owner to end the game at any time before the specified duration is complete, creating unfair conditions for participants.

Vulnerability Details

The current implementation of endGame() allows the contract owner to terminate the game prematurely with no restrictions or conditions. The function only checks if the game is active, but doesn't verify if the originally promised game duration has elapsed. This creates an opportunity for the owner to arbitrarily end the game whenever they choose.

function endGame() external onlyOwner {
require(gameActive, "Game not active");
gameActive = false;
emit GameEnded(block.timestamp);
}

Impact

Players lose their promised opportunity to participate for the full duration

  • Undermines trust in the contract and game fairness

  • Allows the owner to manipulate outcomes by ending the game when certain players are ahead

  • Could financially impact players who invested resources expecting a specific timeframe

PoC

function testEndGameBeforeDurationElapsed() public {
game.startGame(100);
vm.warp(block.timestamp + 50);
game.endGame();
assertEq(game.gameActive(), false);
}

Tools Used

manual review

Recommendations

Implement time-based restrictions on the endGame function to prevent premature termination:

function endGame() external onlyOwner {
+ require(block.timestamp >= endTime, "Game duration not elapsed");
require(gameActive, "Game not active");
gameActive = false;
emit GameEnded(block.timestamp);
}

This ensures the game runs for its full promised duration, preventing owner manipulation and creating a fair environment for all participants.

Updates

Lead Judging Commences

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incomplete end game handling

Incorrect values reported when a game is ended early

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.