Root + Impact

Description

• In the declareWinner() function, the GameEnded event is emitted after the pot value is reset to zero.

• As a result this event always emits 0 as the pot value, even though the king actually won a non-zero amount. This breaks expectations for indexers, frontends and monitoring tools that rely on GameEnded for prize tracking.

Risk

Likelihood:

• Always when calling declareWinner() function.

Impact:

• The emitted pot value in the GameEnded event is misleading and incorrect.

• External services (indexers, analytics, UIs) may display inaccurate reward data.

• Reduces transparency and trust for users monitoring game state via events.

• This issue is not just cosmetic. Many third-party systems use GameEnded to trigger UI updates, build game histories, distribute community rewards, or trigger off-chain processes. A false pot value causes logical failures or confusion in all these layers.

Proof of Concept

To reproduce the issue:

1. Let’s assume the pot currently holds 5 ether.

2. A user calls the claimThrone() function multiple times, incrementally increasing the pot.

3. After the last successful claimThrone(), no one claims the throne for the full duration of gracePeriod.

4. An external caller (anyone) calls declareWinner(), triggering the end of the game.

Recommended Mitigation

Store pot in a local variable before modifying it, and emit that value