Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

GameEnded event emits incorrect prizeAmount (always zero)

osok17

Root + Impact

Description

  • The GameEnded event is intended to log the final prize awarded to the winner. However, in declareWinner(), the pot is set to zero before emitting the event. As a result, the prizeAmount in the event is always zero, even though the winner receives the correct amount via pendingWinnings.

pendingWinnings[currentKing] += pot;
@> pot = 0;
@> emit GameEnded(currentKing, pot, block.timestamp, gameRound); // Emits 0

Risk

Likelihood:

  • This occurs every time declareWinner() is called after the grace period.

Impact:

  • All GameEnded logs will show a prize amount of zero.

  • Off-chain systems (e.g. UIs, indexers, analytics) relying on events will display incorrect data.

  • Reduces trust and transparency for users.

Proof of Concept

In a typical game flow, a user claims the throne with ETH, waits for the grace period to expire, and declareWinner() is called. Even though the user receives the correct amount internally, the emitted event always reports the prize as zero due to resetting the pot before emitting. This behavior can be easily reproduced in any test or real scenario.

Recommended Mitigation

Store pot in a local variable before resetting it, and emit that value in the event:

uint256 prizeAmount = pot;
pendingWinnings[currentKing] += prizeAmount;
pot = 0;
emit GameEnded(currentKing, prizeAmount, block.timestamp, gameRound);
Updates

Appeal created

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::declareWinner emits GameEnded event with pot = 0 always

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.