Last Man Standing

First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Submission Details
Severity: medium
Valid

No Max Time Limit Allows Infinite Extension of Game

Description

The lastClaimTime variable is updated every time a user calls claimThrone(). Since each call extends the game by adding a gracePeriod (typically 1 day), users can perpetually delay the game's end by continuously claiming the throne.

This creates an infinite game loop unless claiming the throne becomes economically unviable. There is no upper bound on game duration, which can lead to the contract never progressing to payout or resolution.

require(
block.timestamp > lastClaimTime + gracePeriod,
"Game: Grace period has not expired yet."
);

Risk

  • Medium

Likelihood:

  • The game will continue indefinitely if even one participant keeps claiming the throne within the grace period window.

Impact:

  • The game may never resolve, breaking core assumptions about winner selection and payout timelines.

  • Funds in the pot could be locked indefinitely.

  • Potential DoS on payout logic or platform fee withdrawal.

Proof of Concept

  • none

Recommended Mitigation

  • Add maxGameDuration to maintain solvency in the contract

Updates

Appeal created

inallhonesty Lead Judge 21 days ago
Submission Judgement Published
Validated
Assigned finding tags:

declareWinner time check is not properly done

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.