Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Missing access control.

gustavoo4eva

Root + Impact

Lack of address(0) check and improper initialization of currentKing leads to broken logic and misinterpreted reverts.

Description

  • The claimThrone() function contains a logic flaw combined with the absence of zero-address validation. Initially, currentKing is implicitly set to address(0), and there's no check to prevent it from being treated as a valid player

  • the msg.sender is a zero address address(0) and the statement makes it impossible for players to become current king making the game stuck

// missing zero address check in the require statement
​
​

Risk

Likelihood:

  • It will happen 100% of time after the contract has been deployed

Impact:

  • On deployment, currentKing is address(0). If the zero address somehow calls claimThrone() (e.g., via testing), the contract behaves as if it's a legitimate king, triggering this revert with a misleading message.

Proof of Concept

game initializes and sets address zero as king.

function testZeroAddressAsSender() public {
emit log_address(game.currentKing());
// Fund address(0) with 1 ether so it can send ETH
vm.deal(address(0), 1 ether);
​
// Prank as address(0)
vm.prank(address(0));
console2.log("Calling claimThrone from address(0)");
game.claimThrone{value: 1 ether}();
console2.log("Success");
}
​

Recommended Mitigation

Add zero address checks claimThrone()

+ require(msg.sender != address(0), "Invalid sender.");
-
Updates

Appeal created

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.