Last Man Standing

Root Cause + Impact

Description

• The contract exposes the exact time remaining in the gracePeriod using the public getRemainingTime() view function.

• Combined with public variables like lastClaimTime and gracePeriod, this allows external actors to precisely predict when the game state will change, removing any uncertainty in timing.

• This leads to automated sniping, where a bot or MEV agent can claim the throne just before declareWinner() becomes callable — defeating the game’s intent.

Risk

Likelihood: High

• The grace period timer is fully observable and deterministic.

• Any external bot with mempool access can calculate optimal sniping windows in real-time.

Impact: Medium

• Funds are not directly at risk.

• However, game integrity is undermined, and human players are at a systemic disadvantage compared to automated bots.

Proof of Concept

This logic can be wrapped in a loop, scheduled off-chain, or embedded in MEV bots to monitor the mempool and submit a claimThrone() just before the grace period ends.

Recommended Mitigation

Additional improvements:

1. Randomize Grace Period Expiry
   Use blockhash or VRF to add jitter to the grace period end time.

2. Commit-Reveal System
   Require users to commit a claim, then reveal it later — increasing fairness.

3. Anti-Sniping Extension Logic
   Automatically extend the grace period if a claim happens too close to expiry.