Submission Details
Impact:
Likelihood:
No Maximum Limit for Platform Fee Percentage
Description
-
The
updatePlatformFeePercentage()function only validates that the percentage is ≤ 100% but has no reasonable upper limit. -
This allows the contract owner to set
platformFeePercentage = 100%, effectively capturing all incoming funds and leaving nothing for the game pot.
function updatePlatformFeePercentage(uint256 _newPlatformFeePercentage)
external
onlyOwner
isValidPercentage(_newPlatformFeePercentage) // Only checks <= 100
{
platformFeePercentage = _newPlatformFeePercentage;
emit PlatformFeePercentageUpdated(_newPlatformFeePercentage);
}
Risk
Impact:
-
Owner can set fee to 100% and steal all player funds
-
No money goes to pot, so there's no prize
Proof of Concept
// Initially game has reasonable 5% platform fee
assertEq(game.platformFeePercentage(), 5);
// Owner maliciously sets platform fee to 100%
vm.prank(deployer);
game.updatePlatformFeePercentage(100);
assertEq(game.platformFeePercentage(), 100);
// Player tries to play, thinking they're contributing to pot
uint256 claimAmount = 1 ether;
uint256 initialPot = game.pot();
uint256 initialPlatformFees = game.platformFeesBalance();
vm.prank(player1);
game.claimThrone{value: claimAmount}();
// VULNERABILITY: 100% goes to platform, 0% to pot
uint256 finalPot = game.pot();
uint256 finalPlatformFees = game.platformFeesBalance();
assertEq(finalPot - initialPot, 0); // No increase in pot!
assertEq(finalPlatformFees - initialPlatformFees, claimAmount); // All goes to owner!
Recommended Mitigation
function updatePlatformFeePercentage(uint256 _newPlatformFeePercentage)
external
onlyOwner
isValidPercentage(_newPlatformFeePercentage)
{
+ require(_newPlatformFeePercentage <= 20, "Game: Platform fee cannot exceed 20%.");
platformFeePercentage = _newPlatformFeePercentage;
emit PlatformFeePercentageUpdated(_newPlatformFeePercentage);
}
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.