Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Error in require statement within `claimThrone` function results in no player ever being able to call it

azriel20005

Root + Impact

Description

  • Players are supposed to be able to call claimThrone function upon creation of the contract to claim the title of currentKing.

  • Due to an error in the require statement, the function requires the caller to be the currentKing's address, rather than ensuring that the caller and the currentKing are different addresses. Since the currentKing is initialised to 0 address, the require statement will never pass.

function claimThrone() external payable gameNotEnded nonReentrant {
require(msg.value >= claimFee, "Game: Insufficient ETH sent to claim the throne.");
@> require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");

Risk

Likelihood: High

  • This function will definitely be called by players and is integral to the operation of the contract.

Impact: High

  • There are adverse impacts as it would cause all functionality to not work and the entire contract would not be able to be used.

Proof of Concept

By creating a simple test code to try and call claimThrone, the function reverts.

function testPlayerClaimThrone() public {
vm.startPrank(player1);
game.claimThrone{value: 1 ether}();
​
assertEq(game.currentKing(), player1);
}

Recommended Mitigation

Amending the erroneous require check would solve the issue.

function claimThrone() external payable gameNotEnded nonReentrant {
require(msg.value >= claimFee, "Game: Insufficient ETH sent to claim the throne.");
- require(msg.sender == currentKing, "Game: You are already the king. No need to re-claim.");
+ require(msg.sender != currentKing, "Game: You are already the king. No need to re-claim.");
Updates

Appeal created

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::claimThrone `msg.sender == currentKing` check is busted

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.