Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

`feeIncreasePercentage` parameter mid-game changes create unfair game conditions

anchabadze

Description:

The updateClaimFeeParameters() function allow the owner to modify feeIncreasePercentage during active gameplay, creating unfair conditions for players who join at different times. These function lack restrictions on when they can be called:

function updateClaimFeeParameters(uint256 _newInitialClaimFee, uint256 _newFeeIncreasePercentage)
external
onlyOwner
isValidPercentage(_newFeeIncreasePercentage)
{
// Can be called anytime - no gameEndedOnly modifier
initialClaimFee = _newInitialClaimFee;
feeIncreasePercentage = _newFeeIncreasePercentage; // Affects current game immediately
}

Attack path:

  1. Game starts with feeIncreasePercentage = 10%

  2. Player A claims throne, pays 1 ETH, next fee becomes 1.1 ETH

  3. Owner calls updateClaimFeeParameters(_, 50%)

  4. Player B claims throne, pays 1.1 ETH, next fee becomes 1.65 ETH

  5. Subsequent players face much higher claimFee escalation

Impact:

Players joining at different times face vastly different economic conditions

Players cannot calculate expected progression costs when joining

Changing game rules mid-play violate gambling fairness regulations

Recommended Mitigation:

Restrict parameter changes to between game rounds and apply them only to new games:

function updateClaimFeeParameters(uint256 _newInitialClaimFee, uint256 _newFeeIncreasePercentage)
external
onlyOwner
gameEndedOnly // Add this modifier
isValidPercentage(_newFeeIncreasePercentage)
{
require(_newInitialClaimFee > 0, "Game: New initial claim fee must be greater than zero.");
initialClaimFee = _newInitialClaimFee;
feeIncreasePercentage = _newFeeIncreasePercentage;
emit ClaimFeeParametersUpdated(_newInitialClaimFee, _newFeeIncreasePercentage);
}
Updates

Appeal created

inallhonesty Lead Judge 30 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.