Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

Unrestricted Platform Fee Allows Complete Prize Pool Drainage

farrellhauzan

Description

  • The platform fee should be a reasonable percentage that allows the game pot to grow and provide meaningful prizes to winners.

  • The constructor and update functions allow platformFeePercentage to be set to 100%, which results in all claim fees going to the platform owner with nothing remaining for the game pot.

constructor(
uint256 _initialClaimFee,
uint256 _gracePeriod,
uint256 _feeIncreasePercentage,
uint256 _platformFeePercentage
) Ownable(msg.sender) {
// @> Allows 100% platform fee, draining entire pot
require(_platformFeePercentage <= 100, "Game: Platform fee percentage must be 0-100.");
platformFeePercentage = _platformFeePercentage;
}

Risk

Likelihood:

  • Owner can explicitly set 100% platform fee during deployment

  • Owner can update to 100% platform fee after deployment via updatePlatformFeePercentage(100)

Impact:

  • Game pot never increases (always remains 0)

  • Winners receive no prize from their participation

  • Game becomes economically non-functional with no incentives

  • Players lose funds with no possibility of winning

Proof of Concept

  1. Deploy contract with _platformFeePercentage = 100

  2. Players claim throne but all fees go to platformFeesBalance

  3. pot remains 0 as amountToPot = sentAmount - currentPlatformFee = sentAmount - sentAmount = 0

  4. Winner gets nothing when they withdraw

Recommended Mitigation

Cap the platform fee to be reasonable amount e.g 20.

constructor(...) {
- require(_platformFeePercentage <= 100, "Game: Platform fee percentage must be 0-100.");
+ require(_platformFeePercentage <= 20, "Game: Platform fee must be less than or equal to 20%"); // reasonable fee
// Update the isValidPercentage modifier:
modifier isValidPercentage(uint256 _percentage) {
- require(_percentage <= 100, "Game: Percentage must be 0-100.");
+ require(_percentage <= 20, "Game: Percentage must be 0-20.");
_;
}
}
Updates

Appeal created

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.