Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Loss of player funds when calling receive function

xgrybto

Root + Impact

Description

  • The receive function is normally used to accept and to handle the transaction correctly regarding the purpose of the contract.

  • A normal transaction reverts if this function is not implemented

  • A player can mistakenly call the contract via the receive function to claim the throne, perhaps thinking that this is the correct process

  • In the Game contract, the receive function is only declared, but don't redirect the call to the claimThrone

  • All funds that are sent through this function will be lost forever, since no prevention was implemented to transfer the total balance of the contract.

receive() external payable {}

Risk

Likelihood:

  • Whenever a player send ethers trough direct transaction.

Impact:

  • Loss of funds of the player

Proof of Concept

In this PoC, we tested that a transaction is accepted by the contract without giving the thone to the player.

function testReceiveFunction() public {
vm.prank(player1);
(bool success, ) = payable(game).call{value: 1 ether}("");
​
vm.assertTrue(success);
​
assertEq(game.getContractBalance(), 1 ether); // The contract balance has been updated
assertNotEq(player1, game.currentKing()); // The player is not the king
}

Recommended Mitigation

In order to fix the issue, we need to make the claimThrone function public. Otherwise, we can't call it and propagate the key information (msg.value, msg.sender, ...)

- function claimThrone() external payable gameNotEnded nonReentrant {}
+ function claimThrone() public payable gameNotEnded nonReentrant {}
​
receive() external payable {
+ claimThrone()
}
Updates

Appeal created

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Direct ETH transfers - User mistake

There is no reason for a user to directly send ETH or anything to this contract. Basic user mistake, info, invalid according to CH Docs.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.