Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Owner Can Manipulate Live Game Parameters Mid-Round

0x00t1

Owner Can Manipulate Live Game Parameters Mid-Round

Description

The functions below allow the contract owner to modify critical game parameters while a round is in progress:

function updateGracePeriod(uint256 _newGracePeriod) external onlyOwner { ... }
​
function updateClaimFeeParameters(uint256 _newInitialClaimFee, uint256 _newFeeIncreasePercentage)
external onlyOwner isValidPercentage(_newFeeIncreasePercentage) { ... }
​
function updatePlatformFeePercentage(uint256 _newPlatformFeePercentage)
external onlyOwner isValidPercentage(_newPlatformFeePercentage) { ... }
​

Unlike resetGame(), which is restricted by the gameEndedOnly modifier, these functions have no restriction preventing changes during an active game.

This means the owner can change grace period, claim fees, and platform fee percentage at any time.

Risk

Likelihood: High

  • The functions are callable by the owner at any time.

  • No time-lock, governance delay, or round-end restriction.

Impact: High

  • Grace period reduction allows the owner or a colluding player to win prematurely.

  • Claim fee and fee increase % change can price out players or accelerate pot growth to owner’s advantage.

  • Platform fee change (up to 100%) can siphon all ETH from claims directly to the owner instead of the pot.

Proof of Concept

Scenario:

  1. Game starts with 24h grace period, 5% platform fee, 10% fee increase.

  2. Owner’s friend becomes king.

  3. Owner calls

updateGracePeriod(1 hours); // drastically shortens the round
updatePlatformFeePercentage(100); // all claim fees go to owner

4. Round ends quickly, friend wins pot, owner collects all platform fees.

Recommended Mitigation

Add gameEndedOnly to all parameter update functions so changes only apply between rounds:

- function updateGracePeriod(uint256 _newGracePeriod) external onlyOwner {
+ function updateGracePeriod(uint256 _newGracePeriod) external onlyOwner gameEndedOnly {
​
- function updateClaimFeeParameters(uint256 _newInitialClaimFee, uint256 _newFeeIncreasePercentage)
- external onlyOwner isValidPercentage(_newFeeIncreasePercentage) {
+ function updateClaimFeeParameters(uint256 _newInitialClaimFee, uint256 _newFeeIncreasePercentage)
+ external onlyOwner gameEndedOnly isValidPercentage(_newFeeIncreasePercentage) {
​
- function updatePlatformFeePercentage(uint256 _newPlatformFeePercentage)
- external onlyOwner isValidPercentage(_newPlatformFeePercentage) {
+ function updatePlatformFeePercentage(uint256 _newPlatformFeePercentage)
+ external onlyOwner gameEndedOnly isValidPercentage(_newPlatformFeePercentage) {
​
Updates

Appeal created

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!