Root + Impact

Description

• The declareWinner() function should emit a GameEnded event that accurately reflects the final pot amount distributed to the winner. Off-chain systems, analytics tools, and UIs rely on this event for displaying accurate game results.

• However, the contract resets the pot to zero before emitting the GameEnded event. As a result, the event logs a prize amount of 0, which does not match the actual payout that occurred internally via pendingWinnings[currentKing] += pot.

Risk

Likelihood:

• This will always occur when declareWinner() is called , the event will report the pot as zero every time.

• Developers and users relying on event logs for prize tracking or frontend display will consistently receive incorrect information.

Impact:

• Event logs provide misleading data about the amount won, breaking trust with users and developers.

• Off-chain services such as subgraphs, dashboards, or game histories will show incorrect winnings for each round.

Recommended Mitigation

Capture the pot amount in a temporary variable before resetting it, and use that for emitting the event.

It preserves the accurate prize value for the event while still resetting the pot afterward.

External systems consuming the GameEnded event will now receive correct and consistent information.