Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Game::declareWinner() Emit event GameEnded() wrong state of parameter pot

vukhuongduy2305

Root + Impact

Description

function Game::declareWinner() emit event GameEnded with parameter pot always equal 0. It should use correct state of pot which before reset.

// Root cause in the codebase with @> marks to highlight the relevant section
function declareWinner() external gameNotEnded {
​
pendingWinnings[currentKing] = pendingWinnings[currentKing] + pot;
@> pot = 0; // Reset pot after assigning to winner's pending winnings
​
@> emit GameEnded(currentKing, pot, block.timestamp, gameRound);
}

Risk

Likelihood:

  • Reason 1: Last each round, when function declareWinner be triggered, it will happend.

Impact:

  • Impact 1: It emit wrong parameter pot of event `GameEnded`, external service or indexer will receive wrong data and cause other service in dapp work incorrect.

Proof of Concept

  • Step 1: Players join the game and claim the throne.

  • Step 2: Now pot > 0, eg, 5 ETH. A user creates a transaction declareWinner.

  • Step 3: Indexer catches an event GameEnded with pot = 0 (wrong, Correct is 5 ETH).

  • Step 4: Indexer (Backend) receives wrong data, so maybe UI will render wrong data for the user, which causes conflict

// Root cause in the codebase with @> marks to highlight the relevant section
function declareWinner() external gameNotEnded {
​
pendingWinnings[currentKing] = pendingWinnings[currentKing] + pot;
pot = 0; // Reset pot after assigning to winner's pending winnings
​
emit GameEnded(currentKing, pot, block.timestamp, gameRound);
}

Recommended Mitigation

function declareWinner() external gameNotEnded {
​
pendingWinnings[currentKing] = pendingWinnings[currentKing] + pot;
+ uint finallyPot = pot;
pot = 0; // Reset pot after assigning to winner's pending winnings
​
emit GameEnded(currentKing, finallyPot, block.timestamp, gameRound);
}
​
Updates

Appeal created

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::declareWinner emits GameEnded event with pot = 0 always

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.