Last Man Standing

First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Submission Details
Severity: medium
Valid

Nobody can play

incorrect logic in claimThrone(), Restricts All Users Except Current King (address zero) and reverts with wrong error message

Description

The claimThrone() function incorrectly enforces that msg.sender == currentKing, effectively allowing only the current king to call the function. This contradicts the intended logic implied by the error message . It prevents any new players from participating and leads to game stagnation.

require(
@> msg.sender == currentKing,
"Game: You are already the king. No need to re-claim."
);

Risk

Likelihood:

Any user calling claimThrone() who is not already the king will immediately hit the revert condition. This is a guaranteed outcome on first use.

Impact:

The game becomes unusable after the first claim. No one can overtake the king, the pot never grows, and the core gameplay (claiming, competing, earning) is fundamentally broken.

Proof of Concept

The game current king game.currentKing() is a zero address and it restricts anybody form making a claim in Game.claimThrone() Player1 cannot even enter the game because the current msg.sender is a zero address. which was made vissible with emit log_address. It reverts because player1 is cannot be msg.sender.

function testPlayer1CanClaimThroneSuccessfully() public {
emit log_address(game.currentKing()); // DEBUG: check initial king
// Player1 claims the throne
vm.prank(player1);
game.claimThrone{value: INITIAL_CLAIM_FEE}();
// Check that player1 is now the current king
address currentKing = game.currentKing();
assertEq(currentKing, player1, "Player1 should be current king");
}

Recommended Mitigation

To make player1 become msg.sender Invert the condition to msg.sender != currentKing, making new entrants be able to claim the throne.

- msg.sender == currentKing
+ msg.sender != currentKing
Updates

Appeal created

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!