Submission Details
Impact:
Likelihood:
Owner Can (Even Unintentionally) Manipulate Grace Period and Claim Fee Mid-Round leading to Unfair Gameplay
# Owner Can (Even Unintentionally) Manipulate Grace Period and Claim Fee Mid-Round leading to Unfair Gameplay
## Description
- Normally, game parameters such as the grace period and claim fee should remain constant during a round to ensure fairness.
- The current implementation allows the owner to update these parameters mid-round, which can be used to indirectly influence the game's outcome.
- In docs it is mentioned that Owner cannot declare a winner before the grace period expires, but in this case although not directly but indirectly it can be done by updating the grace period, eg:- Shortening the grace Period.
- Similarly updating claim fee, mid round can restrict players from claiming the throne, eg;- making it too high.
```javascript
// Root cause in the codebase with @> marks to highlight the relevant section
function updateGracePeriod(uint256 _newGracePeriod) external onlyOwner {
@> gracePeriod = _newGracePeriod;
//...
}
function updateClaimFeeParameters(uint256 _newInitialClaimFee, uint256 _newFeeIncreasePercentage) external onlyOwner isValidPercentage(_newFeeIncreasePercentage) {
@> initialClaimFee = _newInitialClaimFee;
@> feeIncreasePercentage = _newFeeIncreasePercentage;
//...
}
```
## Risk
**Likelihood**:
- This will occur whenever the owner chooses to change parameters during an active round.
- There is no restriction to prevent mid-round changes.
**Impact**:
- The owner can make the game unwinnable or unfair (e.g., set claim fee to an unreasonably high value).
- Indirect manipulation of grace period timing could unfairly favor the owner or selected players.
## Proof of Concept
Owner calls `updateGracePeriod()` or `updateClaimFeeParameters()` during a round to make it impossible or impractical for others to play.
**Proof Of Code**
```javascript
// Example of Deployer keep on increasing Grace Period not allowing anyone to win
function testUpdatingGracePeriodMidRound() public {
vm.startPrank(deployer);
game.claimThrone{value: game.claimFee()}();
_upgradeGraceperiod(2 days);
vm.warp(block.timestamp + GRACE_PERIOD + 1);
game.declareWinner();
vm.stopPrank();
}
// Example of Deployer reducing Grace Period allowing some one to win
function testUpdatingGracePeriodMidRoundTwo() public {
vm.startPrank(deployer);
game.claimThrone{value: game.claimFee()}();
vm.warp(block.timestamp + 2 hours);
_upgradeGraceperiod(1 hours);
game.declareWinner();
vm.stopPrank();
}
```
## Recommended Mitigation
Restrict grace period and claim fee updates to only be allowed between rounds (i.e., when the game has ended).
```diff
- function updateGracePeriod(uint256 _newGracePeriod) external onlyOwner {
+ function updateGracePeriod(uint256 _newGracePeriod) external onlyOwner gameEndedOnly {
- function updateClaimFeeParameters(...) external onlyOwner {
+ function updateClaimFeeParameters(...) external onlyOwner gameEndedOnly {
```
---
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.