Last Man Standing

First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Submission Details
Severity: medium
Valid

Incorrect King check prevents all players from participating

Incorrect logic causes denial of service

Description

  • Normally, when a player calls Game::claimThrone, they become the new King as long as they pay the current claim fee and are not already the King. The function should prevent the current King from reclaiming the throne again.

  • However, the check in the claimThrone function incorrectly restricts everyone except the current King from participating. It uses the condition:

    @> require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");

This allows only the current King (zero address) to claim the throne again, a logic inversion of the intended rule. As a result, no new players can participate after the first King, halting the game entirely.

Risk

Likelihood:

  • This will occur immediately when the first player becomes King.

  • All subsequent attempts to call claimThrone() by any new player will fail due to the incorrect require condition.

Impact:

  • Completely breaks the game mechanics, no one can participate after deployment.

Proof of Concept

This test demonstrates how players can not claim the throne since the function requires the current king only to claim, which happens to be the zero address. It treverts on any attempt.

function test_players_start_the_game() public {
vm.prank(player1);
game.claimThrone{value: INITIAL_CLAIM_FEE}();
}

Recommended Mitigation

Change the faulty line in claimThrone

require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
Updates

Appeal created

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.