Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Erroneous condition in `claimThrone()` only allows current king to call the function

0x00t1

`claimThrown()` can only be called by current king

Description

The claimThrone() function, which is intended to allow any non-king player to claim the throne and become the new king, contains a logic error in the require statement. Instead of preventing the current king from reclaiming the throne, it only allows the current king to call the function — blocking all other players from participating.

This completely breaks the "Last Man Standing" mechanics

function claimThrone() external payable gameNotEnded nonReentrant {
require(msg.value >= claimFee, "Game: Insufficient ETH sent to claim the throne.");
@> require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
...
}

Risk

Likelihood:

  • Always triggered after contract deployment because the first claim will set a currentKing, after which no one else can call claimThrone() except that king.

  • The intended competitive mechanic is effectively disabled in all game rounds.

Impact:

  • No new participants can join the game after the first king is set.

  • The game becomes locked with a single permanent king until manually reset.

  • Pot growth, fee collection, and winner dynamics are all broken.

Proof of Concept

  1. player1 is set as the current king.

  2. player2 attempts to claimthrown but meets a revert message You are already the king. No need to re-claim

function test_Reclaim() public {
vm.startPrank(player1);
game.claimThrone{value: INITIAL_CLAIM_FEE}();
vm.stopPrank();
​
vm.startPrank(player2);
game.claimThrone{value: INITIAL_CLAIM_FEE}(); // Reverts: only current king can call
vm.stopPrank();
}
​
​
Ran 1 test suite in 29.93ms (5.89ms CPU time): 0 tests passed, 1 failed, 0 skipped (1 total tests)
​
Failing tests:
Encountered 1 failing test in test/Game.t.sol:GameTest
[FAIL: Game: You are already the king. No need to re-claim.] test_Reclaim() (gas: 46371)

Recommended Mitigation

Change the require condition to prevent the current king from reclaiming, rather than allowing only the current king:

- require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
+ require(msg.sender != currentKing, "Game: You are already the king. No need to re-claim.");
​
Updates

Appeal created

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!