Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect pot Value Emitted Due to Reset in declareWinner()

mandeepmalik2003

Root + Impact

Description

  • In the normal contract flow, pot should reflect the total amount distributed when a winner is declared.

  • However, in the declareWinner() function, the pot is reset to 0 before the ThroneClaimed event is emitted.

  • As a result, the emitted event logs an incorrect pot value (0 instead of the actual reward), leading to misleading or inaccurate data on-chain.

// Root cause in the codebase with @> marks to highlight the relevant section
function declareWinner() internal {
...
uint256 reward = pot;
@> pot = 0;
emit ThroneClaimed(msg.sender, pot); // Incorrect: emits 0 instead of reward
}

Risk

Likelihood:

  • This occurs every time a new winner is declared — that is, when declareWinner() is called.

  • Any observer (e.g., frontend dApp, indexer, analytics tool) relying on ThroneClaimed event logs for determining actual reward values will log incorrect data.


Impact:

  • Breaks transparency and trust in emitted on-chain data.

  • Off-chain systems could record inaccurate payout histories.

  • Users and developers might misinterpret the event logs, leading to disputes or bugs in integrations.

Proof of Concept

This will always emit a pot value of 0, regardless of the actual reward distributed.

// Simplified logic
function declareWinner() internal {
uint256 reward = pot;
pot = 0;
emit ThroneClaimed(msg.sender, pot); // emits 0
}
​
​

Recommended Mitigation

Instead of relying on pot during the emit, assign it to a local variable beforehand.

​
- pot = 0;
- emit ThroneClaimed(msg.sender, pot);
+ uint256 reward = pot;
+ pot = 0;
+ emit ThroneClaimed(msg.sender, reward);
Updates

Appeal created

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::declareWinner emits GameEnded event with pot = 0 always

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.