Submission Details
Severity:
# Prize Amount in Event Is Always Zero emits Incorrect Event Data
# Prize Amount in Event Is Always Zero emits Incorrect Event Data
## Description
- Normally, the GameEnded event should emit the actual prize amount won by the winner.
- The current implementation sets pot = 0 before emitting the event, so the event always shows a prize of zero.
```javascript
// Root cause in the codebase with @> marks to highlight the relevant section
function declareWinner() external gameNotEnded {
//...
pendingWinnings[currentKing] = pendingWinnings[currentKing] + pot;
@> pot = 0; // Reset pot after assigning to winner's pending winnings
//@audit pot = 0, and then you emitted the event so it would show prize won as 0.
@> emit GameEnded(currentKing, pot, block.timestamp, gameRound);
}
```
## Risk
**Likelihood**:
- This will occur every time a winner is declared.
- The event log will always show a prize of zero.
**Impact**:
- Off-chain systems and users relying on event logs will see incorrect prize information.
- Reduces transparency and trust in the contract.
## Proof of Concept
- Declare a winner and check the emitted GameEnded event; the prize amount is always zero.
**Proof Of Code**
```javascript
game.claimThrone{value: game.claimFee()}();
vm.warp(block.timestamp + game.gracePeriod() + 1);
vm.expectEmit(true, false, false, true);
emit GameEnded(game.currentKing(), game.pot(), block.timestamp, game.gameRound());
game.declareWinner();
```
## Recommended Mitigation
Emit the event with the correct prize amount before resetting the pot.
```diff
- pot = 0; // Reset pot after assigning to winner's pending winnings
- emit GameEnded(currentKing, pot, block.timestamp, gameRound);
+ emit GameEnded(currentKing, pot, block.timestamp, gameRound);
+ pot = 0; // Reset pot after assigning to winner's pending winnings
```
---
Updates
Appeal created
inallhonesty about 2 months ago
Submission Judgement Published Assigned finding tags:
Game::declareWinner emits GameEnded event with pot = 0 always
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.