Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Access Control in `claimThrone()` Function Allows Only Current King to Claim Throne

blazex

Description

  • The claimThrone() function is designed to allow any player to claim the throne by paying the required claimFee, becoming the new "King" and replacing the current one, as long as they are not already the current king.

  • However, due to an incorrect condition in the require statement, only the current king can successfully call claimThrone(), while all other players are blocked, preventing the intended game progression where multiple players compete to overthrow the king.

function claimThrone() external payable gameNotEnded nonReentrant {
require(msg.value >= claimFee, "Game: Insufficient ETH sent to claim the throne.");
//@> require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
// ...
currentKing = msg.sender;
// ...
}

Risk

Likelihood:

  • This issue triggers every time a player who is not the current king attempts to claim the throne, which is the primary interaction in the game.

  • Players will attempt to claim the throne frequently as part of normal gameplay, making this a constant barrier.

Impact:

  • The game becomes locked to the first player who claims the throne, as no other player can replace them, halting the competitive mechanic entirely.

  • Players lose trust in the game, and the accumulated pot cannot be fairly contested, undermining the contract's purpose.

Proof of Concept

// 1. Player A calls claimThrone() with sufficient ETH and becomes currentKing.
// 2. Player B attempts to claim the throne:
Game.claimThrone{value: claimFee}(); // Reverts because msg.sender != currentKing
// 3. Only Player A can call claimThrone() again, but no other player can participate.

Recommended Mitigation

- require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
+ require(msg.sender != currentKing, "Game: You are already the king. Cannot claim again.");
Updates

Appeal created

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.