Last Man Standing

First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Submission Details
Severity: medium
Valid

NO ONE IS ABLE TO CLAIM THE THRONE

In Game.sol No one is able to claim the throne due logical error

Description

A critical logical error in the Game.sol::claimThrone function prevents any user from successfully claiming the throne effectively making the game unplayable.

Root Cause

This condition allows only the current king to proceed, which is the opposite of the intended logic. According to the game rules, the current king should NOT be allowed to reclaim the throne. The check should prevent re-claims by the same address, not enforce them.

As a result:

  • When the contract is first deployed (currentKing == address(0)), any attempt to claim the throne fails because the user is not the king.

  • Even when the throne has not been claimed yet, no address can ever succeed, because the check only allows the current king to proceed, which defeats the purpose.

// @audit-issue high no one can claim the throne
require(
@> msg.sender == currentKing,
"Game: You are already the king. No need to re-claim."
);

Risk

Likelihood: HIGH

  • Every time when someone is trying to claim the throne. Even when the king has never been set to a player

Impact: HIGH

  • Makes the Game unplayable for everyone.

Proof of Concept

This require stateme checks whether the user is a king, if so than only proceeds to further execution which is totally opposite of what protocol has intended to which not letting king to re claim the throne. In this case, it will revert with the error. Paste the following code inside the Game.t.sol

function testOnlyKingIsAbleToClaim() public {
vm.prank(player1);
vm.expectRevert("Game: You are already the king. No need to re-claim.");
game.claimThrone{value: 10e18}();
}

Recommended Mitigation

Apply this changes to overcome the issue inside the Game.sol::claimThrone function.

require(
- msg.sender == currentKing,
+ msg.sender != currentKind,
"Game: You are already the king. No need to re-claim."
);
Updates

Appeal created

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.