Last Man Standing

First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Submission Details
Severity: high
Valid

Game can be gamed by claiming the throne at the last Moment

Incentive misalignment leads to timing exploit

Description

  • In the current implementation, the last player to claim the throne before the grace period ends becomes the winner and receives the full pot.

  • There is no additional benefit to claiming early in the game, and no penalty or difficulty for claiming the throne at the very last second.

  • This creates a strategic flaw: players are incentivized to wait until the last possible moment to claim the throne, allowing them to snipe the pot with minimal effort and maximum reward.

Risk

Likelihood:

  • This behavior will occur frequently, especially once players realize that early claims provide no advantage.

  • Players will begin to monitor the end of the grace period and only claim close to expiry to maximize reward and minimize risk.

Impact:

  • Discourages players from engaging early in the game.

  • Reduces fairness, as players who build the pot through early participation are effectively subsidizing the final "sniper."

Proof of Concept

This test demonstrates how a players enter at the last moment and wins the pot while other palyers entered way earlier and clearly no chances of them winning the pot

function test_can_be_gamed() public {
// Some players enter first way before grace period ends
vm.prank(player1);
game.claimThrone{value: INITIAL_CLAIM_FEE}();
vm.prank(player2);
game.claimThrone{value: 1.1e17}();
// Third player enters towards the end of the game
vm.warp(block.timestamp + 86400 seconds);
vm.prank(player3);
game.claimThrone{value: 1.21e17}();
// And player three is declared winner
vm.warp(block.timestamp + 86401 seconds);
uint256 pot = game.pot();
game.declareWinner();
assertEq(game.getWinnersBalance(player3), pot);
}

Recommended Mitigation

Use a Chainlink VRF powered raffle system where each throne claim grants tickets, and the winner is selected randomly at game end to prevent last minute sniping and reward overall participation.

Updates

Appeal created

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone can still be called regardless of the grace period

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.