Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

False Decentralization

martinyordanov2

Description

  • The architecture is centralized. A single owner has complete control over all critical game parameters. Therefore, he can transfer the ownership to a malicious actor and abuse contestant's funds.

contract Game is Ownable {
function updatePlatformFeePercentage(uint256 _newPlatformFeePercentage) external onlyOwner {
}
​
function updateClaimFeeParameters(uint256 _newInitialClaimFee, uint256 _newFeeIncreasePercentage) external onlyOwner {
}
​
function withdrawPlatformFees() external onlyOwner {
}
​
function transferOwnership(address newOwner) public virtual onlyOwner {
}
}
​

Risk

Likelihood:

  • The owner can abuse their power to exploit players without warning or user consent

  • Ownership transfer can be done instantly which leads to immediate risk

Impact:

  • Owner can steal 100% of all future player funds by setting platform fees to maximum

  • Owner can setup the grace period to a very minimal time frame

Proof of Concept

function testOwnership() public {
vm.prank(deployer);
game.transferOwnership(maliciousActor);
assertEq(game.owner(), maliciousActor);
​
vm.startPrank(maliciousActor);
game.updatePlatformFeePercentage(100);
game.updateGracePeriod(1); // instant wins?
vm.stopPrank();
}

Recommended Mitigation

  1. Add reasonable bounds to prevent abuse

  2. Implement a DAO governance

+ uint256 public constant MAX_PLATFORM_FEE = 20; // Maximum 20% platform fee
+ uint256 public constant MIN_GRACE_PERIOD = 1 hours;
+ uint256 public constant MAX_GRACE_PERIOD = 7 days;
​
function updatePlatformFeePercentage(uint256 _newPlatformFeePercentage)
external
onlyOwner
isValidPercentage(_newPlatformFeePercentage)
{
+ require(_newPlatformFeePercentage <= MAX_PLATFORM_FEE, "Platform fee too high");
platformFeePercentage = _newPlatformFeePercentage;
}
​
function updateGracePeriod(uint256 _newGracePeriod) external onlyOwner {
- require(_newGracePeriod > 0, "New grace period must be greater than zero.");
+ require(_newGracePeriod >= MIN_GRACE_PERIOD && _newGracePeriod <= MAX_GRACE_PERIOD, "Grace period out of bounds");
gracePeriod = _newGracePeriod;
}
Updates

Appeal created

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.