Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: low
Invalid

Zero platformFeePercentage Allowed in updatePlatformFeePercentage Disrupts Fee Collection

mentemdeus

Description

The Game contract updatePlatformFeePercentage function allows the owner to set platformFeePercentage to any value between 0 and 100 via the isValidPercentage modifier. Setting platformFeePercentage to 0 results in no platform fees being collected in claimThrone, causing all sentAmount to go to the pot, which can disrupt the game’s economic balance.

​
function updatePlatformFeePercentage(uint256 _newPlatformFeePercentage)
external
onlyOwner
@> isValidPercentage(_newPlatformFeePercentage)
{
platformFeePercentage = _newPlatformFeePercentage;
emit PlatformFeePercentageUpdated(_newPlatformFeePercentage);
}
​
// Modifier
modifier isValidPercentage(uint256 _percentage) {
@> require(_percentage <= 100, "Game: Percentage must be 0-100.");
_;
}

Risk

Likelihood:

Owner can set platformFeePercentage = 0 intentionally or by mistake, as the modifier allows it.
Common during testing or misconfiguration, especially if the owner underestimates the impact.

Impact:

No platform fees are collected, reducing owner incentives and potentially starving contract operations.

Proof of Concept

Before running this test, Kindly change the clamThrone require to
require(msg.sender != currentKing);

function test_UpdatePlatformFeePercentageto_Zero() public {
vm.prank(deployer);
//deployer sets platformfeepercentage to zero
game.updatePlatformFeePercentage(0);
assertEq(game.platformFeePercentage(), 0, "Platform fee percentage should be 0");
​
vm.startPrank(player1);
vm.deal(player1, 0.1 ether);
game.claimThrone{value: 0.1 ether}();
​
assertEq(game.platformFeesBalance(), 0, "Platform fees should be 0");
assertEq(game.pot(), 0.1 ether, "Entire sentAmount goes to pot");
vm.stopPrank();
}

Tool Used

Manual Review

Code Snippet

https://github.com/CodeHawks-Contests/2025-07-last-man-standing/blob/47d9d19a78acb52270269f4bff1568b87eb81a96/src/Game.sol#L133

Recommended Mitigation

Consider addng this line of code in isValidPercentage modifier

modifier isValidPercentage(uint256 _percentage) {
- require(_percentage <= 100, "Game: Percentage must be 0-100.");
+ require(_percentage > 0 && _percentage <= 100, "Game: Percentage must be 1-100.");
_;
}
Updates

Appeal created

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.