Root + Impact

Description

• The declareWinner function relies on block.timestamp to determine whether the grace period has elapsed and a winner can be declared.

• However, using block.timestamp as a critical timing mechanism introduces a vulnerability. Since validators can slightly manipulate the timestamp of a block (within a tolerance of ~15 seconds), a malicious validator could intentionally delay or accelerate the game’s conclusion. This could extend the game duration beyond the expected grace period and allow another player (different from the current king) to submit a valid claim just before the adjusted timeout. It can undermine the fairness of the game outcome and such manipulation, while subtle, could be enough to alter the final result in favor of a user colluding with a validator or running their own node.

Risk

Likelihood:

• One possible attack scenario is that a validator, acting independently, notices the opportunity to manipulate block.timestamp and exploits it by claiming the throne just before the grace period ends—effectively front-running the current king.

• Another scenario involves collusion: a player may reach out to a validator and offer a portion of the prize pot in exchange for subtle timestamp manipulation that extends or shortens the grace period. This would allow the malicious player to bypass the intended game mechanics and claim victory unfairly.

Impact:

• The fairness and integrity of the game are compromised.

• An honest player, who would have legitimately won under normal conditions, may lose due to validator manipulation.

• A malicious actor can unfairly claim the prize pot, resulting in direct financial loss for the rightful winner.

Proof of Concept

Recommended Mitigation

A general rule of thumb in smart contract security is that if a contract can tolerate a 30-second timestamp variation and maintain integrity, then it is safe to use a timestamp. In case of this game, such variation can lead to a drastic result change and it's recommended to use block.number as a reference point in the game.