Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

M: Inaccurate Balance Reporting (Accounting Discrepancy)

sidrahh12

Inaccurate Balance Reporting (Accounting Discrepancy)

Description

  • The getContractBalance() function is documented to reflect the game's available funds (pot + fees), but incorrectly reports raw ETH balance.

  • This creates financial misrepresentation during critical operations when:

    • Withdrawals are pending

    • Claims are in progress

    • Funds are mid-transfer

function getContractBalance() public view returns (uint256) {
// @> Blindly returns full balance instead of accounting for allocations
return address(this).balance;
}

Risk

Likelihood: High

  • Occurs during all withdrawal operations

  • Persists until blockchain state finalization

Impact: Medium

  • Financial reporting inaccuracies

  • Could enable withdrawal timing attacks

  • Breaks accounting invariants

Proof of Concept

The issue manifests when:

  1. A winner withdraws 1 ETH from pot

  2. getContractBalance() still shows original amount until TX completes

  3. External contracts may act on stale balance data

// Test showing the discrepancy
function testBalanceInaccuracy() public {
// Setup game with 1 ETH pot and 0.1 ETH fees
vm.prank(player1);
game.claimThrone{value: 1.1 ether}();
// Attempt withdrawal while TX is pending
uint256 reportedBalance = game.getContractBalance(); // 1.1 ETH
uint256 actualAvailable = game.pot() + game.platformFeesBalance(); // 1 ETH
assert(reportedBalance != actualAvailable); // Fails
}

Recommended Mitigation

function getContractBalance() public view returns (uint256) {
- return address(this).balance;
+ return pot + platformFeesBalance; // Tracked balances only
}

This ensures:

  1. Accurate reporting of allocated funds

  2. Immunity to transient balance states

  3. Compliance with documented behavior

Updates

Appeal created

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::getContractBalance doesn't behave as it should

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.