Last Man Standing

First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Submission Details
Severity: medium
Valid

Inverted Access Control in `claimThrone` Function Blocks Throne Challenges

Root + Impact

Logical inversion in `require(msg.sender == currentKing)` (should be `!=`) restricts throne claiming *exclusively* to the current king, permanently freezing the game state by blocking all challenges and rendering the core mechanic inoperable.

Description

The function `Game::claimThrone` includes a validation check intended to prevent the current king from re-claiming the throne. However, the condition is implemented in a logically inverted manner. As currently written, the require statement allows the call to proceed only if the sender is the current king, which contradicts the intended access control. This effectively restricts the function to be callable exclusively by the current king, while blocking all other players from claiming the throne. Consequently, the game mechanism is broken, as no new player can ever claim the throne or challenge the current king, rendering the core functionality inoperable.

Proof of Concept

You can add this in `Game.t.sol` and i created function called `getCurrentKing()` return the address for current king
<details>
<summary>PoC</summary>
```solidity
function testKingOnlyCanCallclaimThrone() public {
console2.log("current King: ", game.getCurrentKing());
address king = game.getCurrentKing();
vm.deal(king, 10 ether);
vm.prank(king);
game.claimThrone{value: 5 ether}();
vm.prank(player1);
vm.expectRevert("Game: You are already the king. No need to re-claim.");
game.claimThrone{value: 5 ether}();
}
```
</details>

Recommended Mitigation

Modify the condition
- require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
+ require(msg.sender != currentKing, "Game: You are already the king. No need to re-claim.");
Updates

Appeal created

inallhonesty Lead Judge 9 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.