Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Centralization Risk: Owner (Admin) can cheat and steal all funds

legacy

Root + Impact

The owner(Admin) can update the gracePeriod to a desirable time and as a result, call declare winner and win all the pot which cheats the system everytime.

Description

  • It is expected that the game time can be updated with any chosen parameters (excluding 0).

  • The issue with this very easy implementation is that the owner can set the new time and immediately claim the pot winnings.

function updateGracePeriod(uint256 _newGracePeriod) external onlyOwner {
require(_newGracePeriod > 0, "Game: New grace period must be greater than zero.");
@> gracePeriod = _newGracePeriod;
emit GracePeriodUpdated(_newGracePeriod);
}

Risk

Likelihood:

  • This issue would definitely occur as it is evident that the admin has power to cheat the system

Impact:

  • The impact of this isse is that the admin can win everytime they update the gracePeriod and thereby game the system.

Proof of Concept

The below test shows how the gracePeriod can be manipulated and the admin steals the winnings everytime.


function test_GracePeriodUpdate_UsedToStealPot() public {
vm.prank(deployer);
game.claimThrone{value: 1 ether}();
vm.warp(block.timestamp + 1 hours +1);
vm.prank(deployer);
game.updateGracePeriod(1 hours);
vm.prank(deployer);
game.declareWinner();
​
uint256 deployerBalanceBefore = deployer.balance;
​
vm.prank(deployer);
game.withdrawWinnings();
​
uint256 deployerBalanceAfter = deployer.balance;
assertGt(deployerBalanceAfter, deployerBalanceBefore, "Owner should have withdrawn the pot");
}

Recommended Mitigation

Listed below are some steps recommended to tackle the issue:

​
Store the gracePeriod in a per-round struct at time of throne claim (immutable).
​
Strictly only allow updateGracePeriod() between game rounds or after the current round ends.
​
Updates

Appeal created

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!