Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Owner can extract 100% of claim fees via platform fee manipulation

fredo182

Owner can extract 100% of claim fees via platform fee manipulation

Description

The platformFeePercentage determines how much of the claimFee goes to the owner, with the rest distributed to the pot and eventually the winner. However, the contract allows the owner to update this fee at any time - including setting it to 100%. This creates an opportunity for the owner to extract the full fee as profit and immediately restore a lower fee to hide the action.

function updatePlatformFeePercentage(uint256 _newPlatformFeePercentage)
external
onlyOwner
isValidPercentage(_newPlatformFeePercentage)
{
@> platformFeePercentage = _newPlatformFeePercentage;
emit PlatformFeePercentageUpdated(_newPlatformFeePercentage);
}

Risk

Likelihood: Medium

This can occur at any time during the game since the fee is mutable by the owner. In an MEV or bot-controlled scenario, a frontrunning transaction can set the fee to 100%, drain all ETH, and reset in the same block.

Impact: High

All funds from claims are routed to the owner, breaking the incentive system.

Proof of Concept

function test_platformFeeLeavesPotEmpty() public {
vm.prank(deployer);
game.updatePlatformFeePercentage(100);
​
vm.prank(player1);
game.claimThrone{value: INITIAL_CLAIM_FEE}();
assertEq(game.platformFeesBalance(), INITIAL_CLAIM_FEE);
assertEq(game.pot(), 0, "Pot should be empty after platform fee is 100%");
}

This can also be performed by a miner or a bot in an MEV sandwich or same-block atomic sequence.

Recommended Mitigation

Add a max reasonable fee constraint which the platform fee cannot exceed and players are aware.

+ uint256 public constant MAX_REASONABLE_FEE = 10; // 10%
​
- platformFeePercentage = _newPlatformFeePercentage;
+ require(_newPlatformFeePercentage <= MAX_REASONABLE_FEE, "Game: Platform fee too high.");
+ platformFeePercentage = _newPlatformFeePercentage;
Updates

Appeal created

inallhonesty Lead Judge 15 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.