Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

claimThrone() Locked at Deployment — Only `CurrentKing` Can Call Initially

ksiddharth346

Description

In the current implementation of claimThrone(), the contract enforces that msg.sender must be equal to currentKing. However, upon deployment, currentKing is initialized to address(0), meaning only address(0) can call claimThrone() initially — which is impossible on-chain. This condition permanently locks the function and prevents any player from claiming the throne, effectively breaking the core gameplay.

function claimThrone() external payable gameNotEnded nonReentrant {
@> require(msg.sender == currentKing, "Only current king can call this.");
...
}
​

Risk

  • HIGH

Likelihood:

  • Occurs immediately upon deployment, on the first ever claimThrone() attempt.

  • Will always trigger in production unless manually initialized via a privileged function (which is not ideal for fairness or decentralization).

Impact:

  • Game halts entirely — no user can become king.

  • Game logic becomes unreachable, and the contract becomes unusable without redeployment or admin intervention.

Proof of Concept

  1. Deploy the contract.

  2. Try calling claimThrone() from any EOA:

    game.claimThrone{value: claimFee}(); // reverts

  3. Fails with:

    Game: You are already the king. No need to re-claim..

  4. Because currentKing == address(0) and no valid address can ever be msg.sender == address(0).

function testClaimThrone_Reverts_IfNoInitialKingSet() public {
uint256 sentAmount = 0.1 ether;
​
// Expect revert because currentKing is address(0) and only currentKing can call claimThrone
vm.prank(maliciousActor);
vm.expectRevert("Game: You are already the king. No need to re-claim.");
game.claimThrone{value: sentAmount}();
}

Recommended Mitigation

  • Fix the require check

- require(msg.sender == currentKing , "you are already king");
+ require(msg.sender != currentKing , "you are already king");
Updates

Appeal created

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!