Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Inverted currentKing Check Blocks All Players from Claiming the Throne

fffuuuming

Root + Impact

Description

  • The function claimThrone() has access control which it declares that current king can't re-claim.

  • However, the actual implementation logic is inverted, it allows only the current king to call claimThrone(), while blocking all other players from participating.

function claimThrone() external payable gameNotEnded nonReentrant {
require(msg.value >= claimFee, "Game: Insufficient ETH sent to claim the throne.");
@> // below check blocks all player from claiming throne
require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
​
...
}

Risk

Likelihood: High

  • The incorrect logic is already inside the contract and would immediately block all other players from interacting.

Impact: High

  • It prevents the primary functionality of the game — no one can claim the throne since initial current king is address(0)

Proof of Concept

Add the following test, then run the command: forge test --match-test testclaimThroneFail

function testclaimThroneFail() public {
vm.prank(player1);
vm.expectRevert("Game: You are already the king. No need to re-claim.");
game.claimThrone{value: INITIAL_CLAIM_FEE}();
}

Recommended Mitigation

Check if msg.sender != currentKing in claimThrone() to implement the correct access control

function claimThrone() external payable gameNotEnded nonReentrant {
require(msg.value >= claimFee, "Game: Insufficient ETH sent to claim the throne.");
+ require(msg.sender != currentKing, "Game: You are already the king. No need to re-claim.");
- require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
​
...
}
Updates

Appeal created

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.