Root + Impact

Description

• The claimThrone() function should accept payments that meet the minimum required claim fee and either reject overpayments with clear error messages or automatically refund any excess amount back to the user. Standard practice in financial smart contracts is to process only the required amount and return any surplus to prevent accidental user fund loss, ensuring users pay exactly what is needed for the intended transaction.

• The claimThrone() function only validates that msg.value >= claimFee but processes the entire sent amount without refunding excess ETH to the user. When users accidentally send more than the required claim fee (due to UI errors, copy-paste mistakes, or decimal confusion), the contract keeps all excess funds and distributes them according to the standard fee allocation (platform fees + pot contribution). This creates permanent user fund loss scenarios where a simple input error can result in significant financial losses, as the excess amount is irreversibly integrated into the game's economy rather than being returned to the rightful sender.

  Root Cause in Codebase

  solidity

  function claimThrone() external payable gameNotEnded nonReentrant {

  @> require(msg.value >= claimFee, "Game: Insufficient ETH sent to claim the throne.");

  require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");

  ​

  @> uint256 sentAmount = msg.value; // PROCESSES ENTIRE AMOUNT, NO REFUND

  uint256 previousKingPayout = 0;

  uint256 currentPlatformFee = 0;

  uint256 amountToPot = 0;

  ​

  // Calculate platform fee

  @> currentPlatformFee = (sentAmount * platformFeePercentage) / 100; // FEES ON FULL AMOUNT
  
  

  The function processes the entire msg.value without checking for or refunding excess payments beyond the required claimFee.

  
  

Risk

Likelihood:

• This vulnerability occurs whenever users make input errors while interacting with the contract interface, including common mistakes like sending round numbers (1 ETH instead of 0.1 ETH), copy-paste errors with wrong decimal places, or mobile UI precision issues that make exact amount entry difficult

• The fund loss activates during any legitimate claim attempt where users send more than the required fee, whether due to attempting to include extra gas money, programming errors in automated systems, or simply misunderstanding the exact payment requirements displayed in various wallet interfaces

Impact:

• Permanent and irreversible loss of user funds ranging from small amounts (0.01 ETH overpayments) to catastrophic losses (entire wallet balance accidentally sent), with no recovery mechanism available since the excess becomes integrated into the game's fee structure

• Violation of user expectations and standard DeFi practices where overpayments are typically refunded, creating a poor user experience that can damage the protocol's reputation and discourage participation from users who discover the lack of refund protection

Proof of Concept

This PoC proves the vulnerability by demonstrating various overpayment scenarios where users lose excess ETH permanently. The tests show that the validation logic accepts any payment above the required fee without refunding excess amounts, common user error scenarios that lead to fund loss, and the financial impact calculation showing how overpayments benefit the contract at users' expense.

Recommended Mitigation

Modify the function to only process the required claimFee amount and automatically refund any excess payment back to the user. This approach follows standard DeFi practices by ensuring users only pay exactly what is required for the transaction while protecting them from accidental overpayments. The refund mechanism prevents permanent fund loss from common user errors like decimal mistakes, copy-paste errors, or UI precision issues, improving user experience and maintaining trust in the protocol's fairness and user protection standards.