Last Man Standing

Description

• The updatePlatformFeePercentage function lacks a modifier, enabling the owner to directly modify the platform fee percentage even while the throne claim game is still active.

Risk

Impact:

• During normal player participation, if the admin can arbitrarily change the fee percentage, it becomes unfair to the player who will eventually win.

• As the game progresses, an increased platform fee reduces the amount added to the pot per claim, slowing down prize accumulation and diminishing the final reward for the winner.

Proof of Concept

0. This verification assumes the claimThrone function has already fixed the following two issues:

   1. Correct initial check: require(msg.sender != currentKing, "Game: You are already the king. No need to re-claim.");

   2. Proper handling of the previous king's reward: uint256 previousKingPayout = (sentAmount * previousKngFeePercentage) / 100;

1. Admin deploys the contract.

2. Player player1 pays the claim fee and calls claimThrone.

3. Player player2 pays the claim fee and calls claimThrone.

4. Admin calls updatePlatformFeePercentage to increase the platform fee.

5. Player player1 pays the claim fee and calls claimThrone, contributing less to the pot due to the higher fee.

6. Player player2 pays the claim fee and calls claimThrone, also contributing less to the pot.

Recommended Mitigation

• Simply add the gameEndedOnly modifier to the updatePlatformFeePercentage function, restricting the admin to only update the fee percentage after the game has ended: