The root cause lies in a logic inversion in the claimThrone() function. Instead of rejecting calls from the current king, the contract mistakenly rejects everyone else. As a result, no one can claim the throne except the existing king (initially address(0)) — who is disallowed from reclaiming by design. This creates a logic contradiction and breaks the core flow of the game.
The impact is critical: the game becomes non-functional after the deployment, halting all progression. Players are unable to participate, and the owner cannot reset the game until a winner is declared — which can never happen if no one can claim.
Affected code:
Game.sol::claimThrone()
Normally, players can claim the throne if they are not already the current king, by paying the current claimFee.
The claimThrone() function incorrectly prevents all valid claims by requiring the caller to be the current king, rather than not the current king.
Likelihood:
The likehood is High because:
Always occurs after the first throne claim is made by any non-zero address.
Prevents all subsequent players from interacting with the game.
Impact:
The impact is high because the issue:
Completely halts the core game mechanic.
Causes a Denial-of-Service and breaks user flow.
Add the test bellow inside the Game.t.sol and run the test use the following script:
Result:
Inisde the Game.sol::claimThrone() invert the require statement from == to != to ensure only different user can claim the throne from the previous one.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.