Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Unable to claim throne

mavrikdev

Root + Impact

Description

  • When game is initiated the initial currentKing is set to address(0). When a user attempts to claimThrone the function checks that the user is not the currentKing to prevent them from making claims back to back.

  • The issue is that the claimThrone function mistakenly requires currentKing == msg.sender. This prevents any player claiming the throne, making the game impossible to participate.

function claimThrone() external payable gameNotEnded nonReentrant {
...
require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
...
}

Risk

Likelihood:

  • Highly likely as its the main entry point for participants in the game.

Impact:

  • High impact as it prevents the game from being played.

Proof of Concept

This test proves that when a new game is initiated the currentKing is not equal to the address of player1. Despite this when calling the claimThrone function as player1, the function still reverts with the error claiming player1 is already the king.

function test_ClaimThroneRevert() public {
vm.prank(deployer);
game = new Game(INITIAL_CLAIM_FEE, GRACE_PERIOD, FEE_INCREASE_PERCENTAGE, PLATFORM_FEE_PERCENTAGE);
​
assertNotEq(game.currentKing(), player1); //Player 1 is not currentKing and should be able to claim;
​
vm.prank(player1);
vm.expectRevert('Game: You are already the king. No need to re-claim.');
game.claimThrone{value: 1 ether}();
}

Recommended Mitigation

The require always checks for a true boolean. So it is recommended that the require statement be inverted to always check that the sender is not the currentKing.

- require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
+ require(msg.sender != currentKing, "Game: You are already the king. No need to re-claim.");
Updates

Appeal created

inallhonesty Lead Judge 14 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.