Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

The `updateClaimFeeParameters` function lacks a modifier, allowing direct parameter changes while the throne claim is still ongoing.

minos

Description

  • The updateClaimFeeParameters function lacks a modifier, enabling the owner to directly modify fee parameters even while the throne claim game is still active.

Risk

Impact:

  • During normal player participation, if the admin can arbitrarily change fee parameters, it becomes unfair to both existing and future players.

  • Players cannot predict whether their costs might suddenly increase significantly during their participation.

Proof of Concept

  1. This verification assumes the claimThrone function has already fixed the following two issues:

    1. Correct initial check: require(msg.sender != currentKing, "Game: You are already the king. No need to re-claim.");

    2. Proper handling of the previous king's reward: uint256 previousKingPayout = (sentAmount * previousKngFeePercentage) / 100;

  2. Admin deploys the contract.

  3. Player player1 pays the claim fee and calls claimThrone.

  4. Player player2 pays the claim fee and calls claimThrone.

  5. Admin calls updateClaimFeeParameters to increase the entry fee.

  6. Player player1 must now pay a significantly higher fee to claim the throne again.

  7. Player player2 must also pay a significantly higher fee to claim the throne again.

Recommended Mitigation

  • Simply add the gameEndedOnly modifier to the updateClaimFeeParameters function, restricting the admin to only update parameters after the game has ended:

/**
* @dev Allows the contract owner to update the initial claim fee and fee increase percentage.
* @param _newInitialClaimFee The new initial claim fee.
* @param _newFeeIncreasePercentage The new fee increase percentage (0-100).
*/
function updateClaimFeeParameters(
uint256 _newInitialClaimFee,
uint256 _newFeeIncreasePercentage
- ) external onlyOwner isValidPercentage(_newFeeIncreasePercentage) {
+ ) external onlyOwner gameEndedOnly isValidPercentage(_newFeeIncreasePercentage) {
require(_newInitialClaimFee > 0, "Game: New initial claim fee must be greater than zero.");
initialClaimFee = _newInitialClaimFee;
feeIncreasePercentage = _newFeeIncreasePercentage;
emit ClaimFeeParametersUpdated(_newInitialClaimFee, _newFeeIncreasePercentage);
}
Updates

Appeal created

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.