Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Event Emitted with Incorrect pot Value (Reset Before Emission)

priyankmakwana

Root + Impact

Description

The WinnerDeclared event is meant to log the winner along with the pot amount they won. However, the pot variable was being reset to 0 before the event was emitted:

pot = 0;
emit WinnerDeclared(currentKing, pot); // Emits 0 instead of actual pot value

This causes the event logs to show an incorrect value (0), misleading off-chain indexers, UIs, and auditors that depend on the event data.

// @pot is reset to 0 before event is emitted
// @This causes WinnerDeclared event to show pot = 0, which is incorrect

Risk

Likelihood:

  • This happens every time the winner is declared.

  • It occurs deterministically due to the order of operations in the declareWinner() function.

Impact:

  • Misleading Event Data: Off-chain systems depending on events will assume the winner got 0.

  • Harder Auditing/Analytics: Pot transfer can't be confirmed by events alone, requiring more effort.

  • Reduced Transparency: Users and dApps may distrust the event logs due to inconsistency.

Proof of Concept

Explanation:

Before Fix:

function declareWinner() external {
require(...);
pot = 0;
emit WinnerDeclared(currentKing, pot); // emits 0
}

After Fix:

function declareWinner() external {
require(...);
emit WinnerDeclared(currentKing, pot); // emits correct value
pot = 0;
}

Result:

  • The emitted WinnerDeclared event contains an incorrect pot amount (0) in the original version.

Recommended Mitigation

Explanation:

Ensure that event emission occurs before any state changes that would modify values important to that event (like pot). This ensures accurate logs and traceability.

- pot = 0;
- emit WinnerDeclared(currentKing, pot);
+ emit WinnerDeclared(currentKing, pot);
+ pot = 0;
Updates

Appeal created

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::declareWinner emits GameEnded event with pot = 0 always

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!