Submission Details
Severity:
Misleading GameEnded Event Emission Due to Premature Pot Reset
Root + Impact
Description
-
The
declareWinner()function emits theGameEndedevent after resetting thepotto0, causing the emittedprizeAmountto always be0. This is misleading for off-chain systems (e.g., frontends, analytics) that rely on the event to track the actual prize won by the king. -
The event should emit the original pot value (before reset) to accurately reflect the prize awarded to the winner.
// Root cause in the codebase with @> marks to highlight the relevant section
function declareWinner() external gameNotEnded {
require(currentKing != address(0), "Game: No one has claimed the throne yet.");
require(
block.timestamp > lastClaimTime + gracePeriod,
"Game: Grace period has not expired yet."
);
gameEnded = true;
pendingWinnings[currentKing] = pendingWinnings[currentKing] + pot;
@> pot = 0; // Reset pot after assigning to winner's pending winnings
@> emit GameEnded(currentKing, pot, block.timestamp, gameRound);
}
Risk
Impact:
-
Off-chain monitoring tools cannot track the actual prize distribution.
Recommended Mitigation
Cache the pot value before resetting it:
- remove this code
+ add this code
function declareWinner() external gameNotEnded {
require(currentKing != address(0), "Game: No one has claimed the throne yet.");
require(
block.timestamp > lastClaimTime + gracePeriod,
"Game: Grace period has not expired yet."
);
gameEnded = true;
+ uint256 prize = pot; // Cache before reset
- pendingWinnings[currentKing] = pendingWinnings[currentKing] + pot;
+ pendingWinnings[currentKing] += prize;
pot = 0; // Reset pot after assigning to winner's pending winnings
- emit GameEnded(currentKing, pot, block.timestamp, gameRound);
+ emit GameEnded(currentKing, prize, block.timestamp, gameRound);
}
Updates
Appeal created
inallhonesty about 1 month ago
Submission Judgement Published Assigned finding tags:
Game::declareWinner emits GameEnded event with pot = 0 always
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.