Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

M: Inaccurate Balance Reporting (Accounting Discrepancy)

sidrahh12

Inaccurate Balance Reporting (Accounting Discrepancy)

Description

  • The getContractBalance() function is documented to reflect the game's available funds (pot + fees), but incorrectly reports raw ETH balance.

  • This creates financial misrepresentation during critical operations when:

    • Withdrawals are pending

    • Claims are in progress

    • Funds are mid-transfer

function getContractBalance() public view returns (uint256) {
// @> Blindly returns full balance instead of accounting for allocations
return address(this).balance;
}

Risk

Likelihood: High

  • Occurs during all withdrawal operations

  • Persists until blockchain state finalization

Impact: Medium

  • Financial reporting inaccuracies

  • Could enable withdrawal timing attacks

  • Breaks accounting invariants

Proof of Concept

The issue manifests when:

  1. A winner withdraws 1 ETH from pot

  2. getContractBalance() still shows original amount until TX completes

  3. External contracts may act on stale balance data

// Test showing the discrepancy
function testBalanceInaccuracy() public {
// Setup game with 1 ETH pot and 0.1 ETH fees
vm.prank(player1);
game.claimThrone{value: 1.1 ether}();
// Attempt withdrawal while TX is pending
uint256 reportedBalance = game.getContractBalance(); // 1.1 ETH
uint256 actualAvailable = game.pot() + game.platformFeesBalance(); // 1 ETH
assert(reportedBalance != actualAvailable); // Fails
}

Recommended Mitigation

function getContractBalance() public view returns (uint256) {
- return address(this).balance;
+ return pot + platformFeesBalance; // Tracked balances only
}

This ensures:

  1. Accurate reporting of allocated funds

  2. Immunity to transient balance states

  3. Compliance with documented behavior

Updates

Appeal created

inallhonesty Lead Judge 14 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::getContractBalance doesn't behave as it should

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.