Submission Details
Severity:
claimThrone logic incorrect
Root + Impact
Only currentKing can claim the throne (un-intended behaviour)
Description
-
currentKing should not be able to claim throne (they already are currentKing)
-
require guard is incorrect
require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
// this guard is incorrect
Risk
Game will not run as expected.
Impact:
Only currentKing would be able to call claimThrone
Proof of Concept
In claimThrone function (line 188), incorrect require guard leading to unintended behaviour.
function claimThrone() external payable gameNotEnded nonReentrant {
require(msg.value >= claimFee, "Game: Insufficient ETH sent to claim the throne.");
require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
uint256 sentAmount = msg.value;
uint256 previousKingPayout = 0;
uint256 currentPlatformFee = 0;
uint256 amountToPot = 0;
// Calculate platform fee
currentPlatformFee = (sentAmount * platformFeePercentage) / 100;
// Defensive check to ensure platformFee doesn't exceed available amount after previousKingPayout
if (currentPlatformFee > (sentAmount - previousKingPayout)) {
currentPlatformFee = sentAmount - previousKingPayout;
}
platformFeesBalance = platformFeesBalance + currentPlatformFee;
// Remaining amount goes to the pot
amountToPot = sentAmount - currentPlatformFee;
pot = pot + amountToPot;
// Update game state
currentKing = msg.sender;
lastClaimTime = block.timestamp;
playerClaimCount[msg.sender] = playerClaimCount[msg.sender] + 1;
totalClaims = totalClaims + 1;
// Increase the claim fee for the next player
claimFee = claimFee + (claimFee * feeIncreasePercentage) / 100;
emit ThroneClaimed(
msg.sender,
sentAmount,
claimFee,
pot,
block.timestamp
);
}
Recommended Mitigation
Correcting the require guard should be sufficient, as shown in diff
- remove this code
require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
+ add this code
require(msg.sender != currentKing, "Game: You are already the king. No need to re-claim.");
Updates
Appeal created
inallhonesty about 2 months ago
Submission Judgement Published Assigned finding tags:
Game::claimThrone `msg.sender == currentKing` check is busted
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.