Submission Details
Severity:
Misleading GameEnded event emits zero pot value
The declareWinner function resets the pot to zero before emitting the GameEnded event, resulting in the event always logging a pot value of zero regardless of the actual winnings transferred.
Description
In the
declareWinner()function, theGameEndedevent is emitted after the pot has already been assigned to the winner and reset to zero. This causes the emittedpotvalue to always be0, which is misleading and does not reflect the actual value awarded.
function declareWinner() external gameNotEnded {
require(currentKing != address(0), "Game: No one has claimed the throne yet.");
require(block.timestamp > lastClaimTime + gracePeriod, "Game: Grace period has not expired yet.");
gameEnded = true;
pendingWinnings[currentKing] = pendingWinnings[currentKing] + pot;
@> pot = 0; // Reset pot after assigning to winner's pending winnings
emit GameEnded(currentKing, pot, block.timestamp, gameRound);
}
Risk
Likelihood:
The issue occurs deterministically every time the game ends.
Impact:
Users and systems that rely on these logs will collect wrong information
Proof of Concept
Add this test to GameTest.t.sol
function test_misleading_event() public {
// Some players enter first way before grace period ends
vm.prank(player1);
game.claimThrone{value: INITIAL_CLAIM_FEE}();
vm.prank(player2);
game.claimThrone{value: 1.1e17}();
vm.warp(block.timestamp + 87000 seconds);
game.declareWinner();
}
Output traces:
├─ [50711] Game::declareWinner()
│ ├─ emit GameEnded(winner: player2: [0xEb0A3b7B96C1883858292F0039161abD287E3324], prizeAmount: 0, timestamp: 87001 [8.7e4], round: 1)
│ └─ ← [Stop]
└─ ← [Stop]
Recommended Mitigation
Reorder the statements in declareWinner so that the GameEnded event is emitted before resetting the pot:
- pot = 0; // Reset pot after assigning to winner's pending winnings
- emit GameEnded(currentKing, pot, block.timestamp, gameRound);
+ emit GameEnded(currentKing, pot, block.timestamp, gameRound);
+ pot = 0; // Reset pot after assigning to winner's pending winnings
Updates
Appeal created
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
Game::declareWinner emits GameEnded event with pot = 0 always
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.