Root + Impact

Description

• Describe the normal behavior in one or more sentences

In the Game contract, the claimThrone() function is publicly accessible and lacks any form of access control or validation on the caller. Under normal circumstances, this function is expected to be called under specific game rules, likely tied to eligibility conditions such as payment, cooldowns, or role-based permissions.

• Explain the specific issue or problem in one or more sentences

However, due to the absence of such checks, any external address can arbitrarily call claimThrone() at any time, making themselves the currentKing and resetting the lastClaimTime. This breaks the intended game flow, undermines fairness, and allows malicious actors to hijack the game mechanics without restriction.

The core issue is the missing access or eligibility validation, leading to full game control being exposed to any user on-chain.

Risk

Likelihood:

• Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

This issue will occur whenever any external user calls the claimThrone() function, as it lacks any form of access control or input validation.

• Reason 2

It also occurs every time a malicious actor wants to override the currentKing value without restriction, since no checks (e.g., payments, cooldowns, ownership validation) are enforced.

Impact:

• Impact 1

Attackers can spam the function to continually seize control of the throne, preventing fair gameplay or participation.

• Impact 2

The game logic becomes unreliable, leading to a broken or exploitable system where the currentKing does not reflect intended behavior or outcomes.

Proof of Concept

Deploy the vulnerable Game contract.

• Deploy the ExploitKingGame contract, passing the address of the Game contract to the constructor.

• Call takeOverThrone() from any address — it will instantly make the caller the new currentKing.

• Repeat the call as many times as desired from any address to override the throne, demonstrating lack of restriction.

Recommended Mitigation

Modify the claimThrone() function to prevent arbitrary or repeated claims without consequence.