Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Access Control in `claimThrone()` Freezes Game

dumbbutt0

Root + Impact

Description

  • The normal behavior of claimThrone() is to allow any new player to become the king by paying the required claimFee. The function should reject only redundant claims from the current king.

  • However, the current implementation mistakenly allows only the current king to call claimThrone(), freezing the game for all other players. This makes the game unplayable after the first claim.

function claimThrone() external payable gameNotEnded nonReentrant {
require(msg.value >= claimFee, "Game: Insufficient ETH sent to claim the throne.");
@> require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
...
}

Risk

Likelihood:

  • This bug will occur immediately after the first claim, as the next player (a different address) will always fail the require(msg.sender == currentKing) check.

  • Since the game requires multiple participants, this stops core game flow by design.

Impact:

  • Players are permanently locked out after one person claims the throne.

  • The declareWinner, claimFee increase, and platform fee logic will never execute again — rendering the game and economy non-functional.

Proof of Concept

function test_GameLocksAfterFirstClaim() public {
game.claimThrone{value: initialFee}();
​
// Simulate a second player trying to claim
vm.prank(address(0xBEEF));
vm.deal(address(0xBEEF), 10 ether);
vm.expectRevert("Game: You are already the king. No need to re-claim.");
game.claimThrone{value: game.claimFee()}();
}

Recommended Mitigation

- require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
+ require(msg.sender != currentKing, "Game: You are already the king. No need to re-claim.");
Updates

Appeal created

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.