Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Event Emitted with Incorrect Value in declareWinner()

codeaudit0x1

Root + Impact

Description

  • The declareWinner() function is expected to emit the GameEnded event with the actual prize amount (pot) that the winner has won before resetting it to zero.

  • Issue:

    The event emits pot after it is reset to zero, causing the event log to display 0 instead of the actual prize amount. This breaks transparency for off-chain systems, indexers, and UIs, which rely on event data for game history and payouts.

pendingWinnings[currentKing] = pendingWinnings[currentKing] + pot;
pot = 0; // Reset pot after assigning to winner's pending winnings
​
emit GameEnded(currentKing, pot, block.timestamp, gameRound);
@> ^^^ (Emits zero instead of actual prize)

Risk

Likelihood:

  • Always occurs when the declareWinner() function is called.

Impact:

  • Off-chain analytics, game history, and frontends will show 0 prize amount.

  • Users might lose trust as logs suggest the prize is zero.

  • Potential compliance and auditing issues since event logs serve as a source of truth for blockchain applications.

Recommended Mitigation

function declareWinner() external gameNotEnded {
require(currentKing != address(0), "Game: No one has claimed the throne yet.");
require(block.timestamp > lastClaimTime + gracePeriod, "Game: Grace period has not expired yet.");
​
gameEnded = true;
​
+ uint256 prizeAmount = pot; // Store actual prize before reset
pendingWinnings[currentKing] = pendingWinnings[currentKing] + pot;
- pot = 0;
+ pot = 0;
​
- emit GameEnded(currentKing, pot, block.timestamp, gameRound);
+ emit GameEnded(currentKing, prizeAmount, block.timestamp, gameRound);
}
Updates

Appeal created

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::declareWinner emits GameEnded event with pot = 0 always

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.