Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

[H-1] No one can claim the throne due to incorrect logic in `Game::claimThrone` function

ayb

[H-1] No one can claim the throne due to incorrect logic in Game::claimThrone function

Description:
The function Game::claimThrone is intended to allow any participant to join the game and claim the throne by sending a value greater than or equal to the claimFee. However, due to the following line:

require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");

No one can actually claim the throne. This check incorrectly requires the caller to already be the king, which makes the function revert for anyone trying to claim the throne due to the currentKing is still address(0).

Impact:

  • No participant can ever claim the throne.

  • The core functionality of the game is completely broken.

  • The contract becomes unusable.

Proof of Concept: Add this function into your Game.t.sol file:

function testClaimThrone_RevertWhenTryingToClaimThrone() public {
vm.prank(player1);
vm.expectRevert("Game: You are already the king. No need to re-claim.");
game.claimThrone{value: 0.1 ether}();
}

This test will fail even though player1 should be able to claim the throne, proving the faulty logic.

Root Cause:
The contract expects the sender to be the address(0), which contradicts the intended logic. When the game starts, currentKing is address(0), so no real user can match that.

Recommended Mitigation: Change this in your Game::claimThrone function :

- require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
+ require(msg.sender != currentKing, "Game: You are already the king. No need to re-claim.");
Updates

Appeal created

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!