Root + Impact

Description

• In the original contract, the receive() function was defined but left empty:

  receive() external payable {}

  This allows ETH to be sent directly to the contract without triggering any logic like claiming the throne. Players could accidentally send ETH and lose funds without actually participating in the game.

  This breaks the core expectation: sending ETH should attempt to claim the throne, as that is the central mechanic of the game.

  By default, most wallets (e.g., MetaMask) allow sending ETH directly, and users might assume doing so interacts with the game. Since no logic was executed, the ETH would simply go into the pot without updating the king or starting a new round.

  After the Fix:

  The receive() function was modified to automatically call claimThrone() when ETH is received:

Risk

Likelihood:

• Medium: Many users interact with smart contracts through wallet UIs or simple sends.

• High on mobile or less technical users who don’t know they must call claimThrone() directly.

Impact:

• Medium: Users may lose ETH unintentionally without gaining king status.

• Leads to poor UX and breaks trust in the protocol.

Proof of Concept

Recommended Mitigation

Explanation:

Automatically call claimThrone() inside the receive() function. This ensures all ETH transfers behave as expected and preserve the integrity of the game's mechanics.