Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Critical comparison operator Error in claimThrone

nem0thefinder

Summary

A critical vulnerability exists in the claimThrone() function due to an incorrect comparison operator. The function uses == instead of != when checking if the sender is already the current king, preventing anyone from claiming the throne and effectively breaking the core game functionality.

Description

The vulnerability is located in claimThrone() function:

require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");

This logic is inverted. The function should prevent the current king from re-claiming the throne, but instead it prevents anyone who is NOT the current king from claiming it.

Current Behavior:

  • If msg.sender is the current king → requirement passes → function continues

  • If msg.sender is NOT the current king → requirement fails → transaction reverts

Expected Behavior:

  • If msg.sender is the current king → requirement fails → transaction reverts with appropriate message

  • If msg.sender is NOT the current king → requirement passes → function continues

Impact

  • Complete Game Breakdown: The core functionality of the game is completely broken. No player can claim the throne except potentially the initial king which is address(0).

  • Financial Loss: Players who attempt to claim the throne will have their transactions fail, wasting gas fees.

  • Contract Becomes Unusable: The primary purpose of the contract (throne claiming mechanism) is non-functional.

Proof of Concept

function test_noOne_can_claimThrone() public {
vm.startPrank(player1);
assert(game.currentKing() != player1); // Confirms player1 is not the current king
vm.expectRevert(); // Expects the transaction to revert
game.claimThrone{value: INITIAL_CLAIM_FEE}(); // Attempt to claim throne fails
vm.stopPrank();
}

Recommended Mitigation

​
- require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
​
+ require(msg.sender != currentKing, "Game: You are already the king. No need to re-claim.");
Updates

Appeal created

inallhonesty Lead Judge 9 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.