The root cause lies in a logic inversion in the claimThrone()
function. Instead of rejecting calls from the current king, the contract mistakenly rejects everyone else. As a result, no one can claim the throne except the existing king (initially address(0)) — who is disallowed from reclaiming by design. This creates a logic contradiction and breaks the core flow of the game.
The impact is critical: the game becomes non-functional after the deployment, halting all progression. Players are unable to participate, and the owner cannot reset the game until a winner is declared — which can never happen if no one can claim.
Affected code:
Game.sol::claimThrone()
Normally, players can claim the throne if they are not already the current king, by paying the current claimFee
.
The claimThrone()
function incorrectly prevents all valid claims by requiring the caller to be the current king, rather than not the current king.
Likelihood:
The likehood is High because:
Always occurs after the first throne claim is made by any non-zero address.
Prevents all subsequent players from interacting with the game.
Impact:
The impact is high because the issue:
Completely halts the core game mechanic.
Causes a Denial-of-Service and breaks user flow.
Add the test bellow inside the Game.t.sol
and run the test use the following script:
Result:
Inisde the Game.sol::claimThrone()
invert the require statement from == to != to ensure only different user can claim the throne from the previous one.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.