Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Grace Period Expiration Check in `claimThrone`

jufel

Description:
The claimThrone function does not verify whether the previous grace period has already expired before accepting a new claim. As a result, if nobody calls declareWinner after the grace period elapses, a late claimant can still call claimThrone, resetting the grace timer and stealing the pot meant for the rightful winner.

Impact:

  • Winner Theft: The true winner—who should be able to call declareWinner after the grace period—can be preempted by a malicious actor, diverting the entire prize pot.

  • Game Fairness Broken: Undermines the core mechanic of the game, as the grace period guarantee can be bypassed.

  • Loss of Trust: Players may lose confidence in the protocol’s integrity.

Proof of Concept: Add the following test to the 'Game.t.sol':

function testClaimAfterGracePeriod() public {
// Would need to fix the contract first (incorrect king validation logic), but this demonstrates the vulnerability
// player1 becomes king
vm.prank(player1);
game.claimThrone{value: INITIAL_CLAIM_FEE}();
​
assertEq(game.currentKing(), player1);
​
// Simulate grace period ending
vm.warp(block.timestamp + GRACE_PERIOD + 1 seconds);
​
// player2 tries to claim throne after grace period
vm.prank(player2);
game.claimThrone{value: game.claimFee()}();
​
assertEq(game.currentKing(), player2);
}

Mitigation:
Introduce a check at the start of claimThrone to ensure the grace period has not yet expired:

function claimThrone() external payable gameNotEnded {
+ require(block.timestamp <= lastClaimTime + gracePeriod,
+ "Game: Grace period has expired. Declare winner first.");
​
// … existing logic …
}
Updates

Appeal created

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone can still be called regardless of the grace period

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!