Last Man Standing

First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Submission Details
Severity: medium
Valid

Missing Tracking of Previous King's Payout Blocks Withdrawal

Root + Impact

When a new player claims the throne, a portion of the sent ETH is meant to be paid to the previous king as a small reward. This ensures fair reward distribution and incentivizes participation

However, the contract does not store or track the previous king's payout anywhere. As a result, the previous king never receives the reward they're promised, and there's no way for them to claim it later. This breaks a core part of the game logic and creates a trust issue


Description

The contract claims to reward the previous king with a small portion of the claim fee whenever a new player claims the throne. This is mentioned in the comment:

// If there's a previous king, a small portion of the new claim fee is sent to them.

However, in the actual implementation, this logic is not executed properly. The variable previousKingPayout is hardcoded to 0 and is never updated with a real calculated amount. As a result, no ETH is actually sent to the previous king.

There is no mechanism to store or withdraw this missing reward later, either. So the previous king completely misses out on the benefit they were supposed to receive. This mismatch between intention and implementation can mislead players and harm the integrity of the game's reward system

Risk

Likelihood:

  • This will occur every time a new king is crowned and there was a previous king.

Impact:

  • The previous king loses their expected reward, which can feel unfair and break trust in the game.

  • This could lead to player dissatisfaction or complaints, especially in a competitive game where ETH is involved.

Proof of Concept

Player A calls claimThrone() — becomes king.
Player B sends ETH and becomes new king.
previousKingPayout intended for Player A is calculated — but never stored or tracked.
Player A has no way to claim it. Funds are lost

Recommended Mitigation

Add a mapping(address => uint256) public PrevKingpayout; to track payouts owed to previous kings.
Then, before updating currentKing, store the payout for the previous king

uint256 previousKingPayout = (sentAmount * previousKingCutPercentage) / 100;
+ PrevKingpayout[currentKing] += previousKingPayout;
Updates

Appeal created

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing Previous King Payout Functionality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.