Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

## Incorrect Condition in claimThrone() ## [ Contradicts Game Rules ]

hawks

Root + Impact

Description

The claimThrone() function contains a logic error that violates the intended game rule:

"Cannot claim the throne if they are already the current king."

Currently, the function uses the following condition:

function claimThrone() external payable gameNotEnded nonReentrant {
require(msg.value >= claimFee, "Game: Insufficient ETH sent to claim the throne.");
require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim."); @>

This incorrectly allows only the current king to call claimThrone(), which contradicts the intended behavior. Instead, any player except the current king should be allowed to claim the throne.
As a result, no player can ever claim the throne unless they are already king, making the game logic unusable.



Risk

Likelihood: High

  • This issue occurs every time the claimThrone() function is called by any address other than the current king — which will always revert. It breaks the core functionality of the game.



Impact:

  • Prevents new players from claiming the throne

  • Makes the game impossible to play

  • Halts progression, rewards, and payouts

Proof of Concept

​

Recommended Mitigation

Update the condition in claimThrone() to reject only current kings, and allow all others to proceed.

This change correctly blocks the current king from re-claiming, while allowing others to participate.

- require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
​
+ require(msg.sender != currentKing, "Game: You are already the king. No need to re-claim.");
Updates

Appeal created

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.