Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Fatal DoS in Function "ClaimThrone()"

alirezahoseini

Root + Impact

Description

  • Normal Behavior: A user should be able to become the currentKing by sending at least the claimFee. Each successful claim increases the claimFee, and updates the currentKing state to the caller.

  • Specific Issue: The contract uses the following logic in Line #176 of ClaimThrone() function:

require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
function claimThrone() external payable gameNotEnded nonReentrant {
require(msg.value >= claimFee, "Game: Insufficient ETH sent to claim the throne.");
​
// >>> Incorrect logic that prevents the game from starting <<<
require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
​
...
}

This logic is reversed — it allows only the current king to claim again, which makes no sense in this context. More critically, when the game starts, currentKing is address(0), and since no user can be address(0), the very first call to claimThrone() will revert, permanently disabling the game.

Risk

Likelihood:

  • This occurs immediately after deployment, since currentKing == address(0).

  • Any address calling claimThrone() will fail the check, so no one can start the game.

Impact:

  • Total denial-of-service — the game is non-functional from the start.

  • No user can ever become king or interact with core functionality.

  • Platform cannot earn fees, pot remains empty, and user funds are locked if sent.

Proof of Concept

function test_FirstClaimReverts() public {
vm.prank(player1);
vm.expectRevert("Game: You are already the king. No need to re-claim.");
game.claimThrone{value: INITIAL_CLAIM_FEE}();
}

This test shows that the very first claim always reverts.

Recommended Mitigation

- require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
+ require(msg.sender != currentKing, "Game: You are already the king. No need to re-claim.");

This ensures:

  1. The game can start properly with the first player.

  2. Only non-kings can claim the throne again.

Updates

Appeal created

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!