Last Man Standing

First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Submission Details
Severity: medium
Valid

Incorrect Check in 'ClaimThrone' function prevents anyone else from Claiming the Throne thus breaking Functionality

Functionality Broken. The 'ClaimThrone' function has a check that prevents anyone else from Claiming the Throne.

Impact : High, as the first Throne Claimer becomes the King forever as noone can Claim the Throne.

Description

  • The Require Check in 'ClaimOwner' checks the msg.sender is equal to the currentKing it reverts as the new throne claimer is ofc not the King.

  • Example:

    Step 1: Patrick (Account A) sends 1 ETH

    he becomes the currentKing

    Step 2: Patricia tries to Claim the Throne (Account B) sends 1.1 ETH or higher

    This line runs:

require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");

Risk : HIGH, breaks the Contracts Functionality

Likelihood: HIGH

  • This will Occur when the First Player will Claim the Throne and become the King and after that noone else can.

Impact: HIGH

  • Functionality Broken no one can play as no new Person can claim the Throne

  • The King System can't proceed further.

Proof of Concept:

Account 1 becomes the King he is the first King since deployment

Account 2 tries to become the king by claimingThrone with the amount greater then the previousAmount but it reverts with error message "You are already the King " While Hes Not!!!

Cause its saying that the msg.sender is equal to currentKing, So No one else can become the king as they aren't the current King.


To demonstrate this issue, we wrote a test where UserA becomes the king, and UserB attempts to claim the throne. The call reverts, even though UserB is not the current king — this is clearly unintended behavior and shows that the logic is flipped

[46399] GameTest::testNewUserCannotClaim_IfRequireBugged()
├─ [0] VM::prank(UserB: [0x7E5F4552091A69125d5DfCb7b8C2659029395Bdf])
│ └─ ← [Return]
├─ [29259] Game::claimThrone{value: 10000000000000000}()
│ ├─ storage changes:
│ │ @ 16: 01
│ └─ ← [Revert] Game: You are already the king. No need to re-claim.
└─ ← [Revert] Game: You are already the king. No need to re-claim.

Recommended Mitigation

This is the recommended Mitigation its simple just add != instead of ==.

- require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
+ require(msg.sender != currentKing, "Game: You are already the king. No need to re-claim.");
Updates

Appeal created

inallhonesty Lead Judge 9 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.