Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

No Maximum Cap on Fee Increase Percentage

r4y4n3

Root + Impact

Description

  • Normal behavior:
    Fee increase percentage should be capped at a reasonable value to keep the game playable and economically balanced.

    Specific issue:
    The contract allows fee increase percentage up to 100%, which would double fees each claim (0.1 → 0.2 → 0.4 → 0.8 ETH), making the game unplayable very quickly.

function updateClaimFeeParameters(
uint256 _newInitialClaimFee,
uint256 _newFeeIncreasePercentage
) external onlyOwner isValidPercentage(_newFeeIncreasePercentage) {
// @> isValidPercentage allows up to 100%
feeIncreasePercentage = _newFeeIncreasePercentage;
}
​
modifier isValidPercentage(uint256 percentage) {
require(percentage <= 100, "Game: Percentage must be between 0 and 100."); // @> Allows 100%
_;
}

Risk

Likelihood:

  • Owner may set extreme values intentionally to extract maximum fees or accidentally due to parameter confusion.

Impact:

  • Game becomes unplayable as fees escalate exponentially.

  • Users are priced out after just a few claims.

  • Economic model breaks down completely.

Proof of Concept

The following test demonstrates that the owner can set fee increase to 100%, making the game unplayable:

function testNoMaximumFeeIncreaseCap() public {
// Owner can set fee increase to 100% (doubling fees each claim)
vm.startPrank(deployer);
game.updateClaimFeeParameters(0.1 ether, 100); // 100% increase allowed
vm.stopPrank();
​
assertEq(game.feeIncreasePercentage(), 100, "Fee increase should be 100%");
// This means fees will double: 0.1 → 0.2 → 0.4 → 0.8 → 1.6 ETH
// Game becomes unplayable very quickly
}

Recommended Mitigation

Cap the fee increase percentage at a reasonable maximum to maintain game playability:

modifier isValidPercentage(uint256 percentage) {
- require(percentage <= 100, "Game: Percentage must be between 0 and 100.");
+ require(percentage <= 50, "Game: Percentage must be between 0 and 50.");
_;
}
Updates

Appeal created

inallhonesty Lead Judge 14 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.