Root + Impact

Description

The contract owner has the ability to modify key gameplay parameters at any time using:

• updateGracePeriod()

• updateClaimFeeParameters()

• updatePlatformFeePercentage()

Since these functions can be called while a round is active, they enable unilateral mid-game rule changes, such as:

• Extending/reducing the gracePeriod

• Making the next claimFee suddenly unaffordable or much cheaper

• Increasing the platformFee to capture more from the pot

This undermines fairness and opens doors to manipulation, especially if the owner is a participant or colluding with one.

Risk

Likelihood:

• Always possible: These functions have no restriction on when they can be called.

• Likely to be abused in high-stakes or high-value rounds.

Impact:

• Game Fairness: Players make decisions based on current rules. Changing them mid-round is deceptive.

• Trust Loss: Players may consider the game rigged or unfair.

• Financial Harm: Players may be tricked into paying unexpectedly high fees or miss winning due to a changed gracePeriod.

Proof of Concept

Example:

Similarly, increasing platformFee mid-round reduces the payout to the winner, or changes fee economics unfairly.

Recommended Mitigation

Explanation:

Freeze gameplay-critical parameters during active rounds. Only allow updates between rounds or schedule them for the next round.