Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

Mid-Game Parameter Updates Enable Owner Manipulation and Unfair Gameplay

farrellhauzan

Description

  • Game parameters like gracePeriod, initialClaimFee, feeIncreasePercentage, and platformFeePercentage should remain stable during active game rounds to ensure fair gameplay for all participants.

  • The contract allows the owner to update these critical parameters at any time, including during active game rounds, creating opportunities for manipulation and unfair advantage.

// @> These functions can be called anytime, even during active games
function updateGracePeriod(uint256 _newGracePeriod) external onlyOwner {
gracePeriod = _newGracePeriod; // @> Affects current game immediately
}
​
function updatePlatformFeePercentage(uint256 _newPlatformFeePercentage) external onlyOwner {
platformFeePercentage = _newPlatformFeePercentage; // @> Changes fees mid-game
}

Risk

Likelihood:

  • Owner has technical ability to change rules at any time during gameplay

  • No restrictions prevent mid-game parameter modifications

  • Centralization risk is inherent in the current design

Impact:

  • Centralization risk allowing owner to manipulate game rules arbitrarily

  • Unfair gameplay where rules change mid-round without player consent

  • Economic manipulation affecting claim costs and winning conditions

  • Loss of player trust and potential abandonment of the game

Proof of Concept

Scenario 1 - Grace Period Manipulation:

  1. Current king has waited 23/24 hours for grace period to expire

  2. Owner calls updateGracePeriod(172800) (48 hours) during active game

  3. Current king must now wait additional 25 hours unexpectedly

  4. This violates player expectations and game fairness

Scenario 2 - Fee Structure Manipulation:

  1. Players enter game with 10% platform fee and 5% fee increase

  2. Owner calls updatePlatformFeePercentage(50) and updateClaimFeeParameters(newFee, 20) mid-game

  3. Next players face dramatically higher costs than earlier participants

  4. Creates unfair economic conditions for later players

Scenario 3 - Immediate Winner Declaration:

  1. Owner calls updateGracePeriod(1) during active round

  2. Current king becomes winner almost immediately

  3. Other players lose opportunity to compete fairly

Recommended Mitigation

Add the gameEndedOnly modifier to all parameter update functions to ensure changes only occur between game rounds:

function updateGracePeriod(uint256 _newGracePeriod) external onlyOwner gameEndedOnly {
require(_newGracePeriod > 0, "Game: New grace period must be greater than zero.");
gracePeriod = _newGracePeriod;
emit GracePeriodUpdated(_newGracePeriod);
}
​
function updateClaimFeeParameters(
uint256 _newInitialClaimFee,
uint256 _newFeeIncreasePercentage
) external onlyOwner gameEndedOnly isValidPercentage(_newFeeIncreasePercentage) {
require(_newInitialClaimFee > 0, "Game: New initial claim fee must be greater than zero.");
initialClaimFee = _newInitialClaimFee;
feeIncreasePercentage = _newFeeIncreasePercentage;
emit ClaimFeeParametersUpdated(_newInitialClaimFee, _newFeeIncreasePercentage);
}
​
function updatePlatformFeePercentage(uint256 _newPlatformFeePercentage)
external onlyOwner gameEndedOnly isValidPercentage(_newPlatformFeePercentage) {
platformFeePercentage = _newPlatformFeePercentage;
emit PlatformFeePercentageUpdated(_newPlatformFeePercentage);
}
Updates

Appeal created

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.