Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Broken King Claim Logic

doormamu

Root + Impact

Description

  • Normally, when a player wants to claim the throne in the game, the function should ensure that they are not already the king.

  • However, the contract incorrectly checks that the caller is already the king, which completely blocks the game's functionality from the start since no one is king initially (address(0)).

Testing

  1. Deploy the contract : currentKing = address(0)

  2. Sam Tries to Claim :

    • msg.sender = Sam

    • Check Sam == address(0)? reverts

// Root cause in the codebase
@> require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");

Risk

Severity: Critical

Likelihood:

  • This will always occur on initial deployment since currentKing is initialized to address(0)

  • Any first-time claim attempt will revert due to the faulty logic

Impact:

  • The game is completely paralyzed

  • No one can ever claim the throne

  • Any ETH sent during failed claim attempts is permanently locked

  • A redeployment of the contract is necessary to fix the logic

Exploitability: Low (only visible in code)


Proof of Concept

address public currentKing;
​
// Incorrect logic
function claimThrone() external payable {
require(msg.sender == currentKing, "Game: You are already the king.");
currentKing = msg.sender;
}

Initial state: currentKing = address(0)

Call: claimThrone() by any player will revert because msg.sender != address(0)


Recommended Mitigation :

Immediate FIx :

- require(msg.sender == currentKing, ",,,");
+ require(msg.sender != currentKing, ",,,");

After Fix :

  1. Deploy the contract : currentKing = address(0)

  2. Sam Tries to Claim :

    • msg.sender = Sam

    • Check Sam != address(0)? proceeds

  3. Sam becomes the king

Updates

Appeal created

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.