Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: medium
Invalid

Owner Can Set Platform Fee to 100%, Draining All Future Claims and Leaving No Winnings for King

alexwebbin

Root + Impact

Description

  • Each time a player claims the throne to be king, a portion of the claim fee(the platform fee percentage) is updated to the platform fees balance. The rest of the claim fee is sent to the pot for the king to claim when the game ends.

  • The contract allows the owner to set the platform fee percentage to 100%. As a result of this, the full claim fee is routed to the owner with nothing to claim in the pot for the king when the game ends.

function updatePlatformFeePercentage(uint256 _newPlatformFeePercentage)
external
onlyOwner
isValidPercentage(_newPlatformFeePercentage)
{
@> platformFeePercentage = _newPlatformFeePercentage;
emit PlatformFeePercentageUpdated(_newPlatformFeePercentage);
}
​
modifier isValidPercentage(uint256 _percentage) {
@> require(_percentage <= 100, "Game: Percentage must be 0-100.");
_;
}
​
currentPlatformFee = (sentAmount * platformFeePercentage) / 100;
​
// Defensive check here doesn't prevent 100% fee
if (currentPlatformFee > (sentAmount - previousKingPayout)) {
currentPlatformFee = sentAmount - previousKingPayout;
}
​
platformFeesBalance += currentPlatformFee;
amountToPot = sentAmount - currentPlatformFee;
pot += amountToPot;

Risk

Likelihood:

  • The issue will occur whenever the contract owner decides to set or update the platform fees percentage to 100%, which in turn would cause all future throne claims to be routed to the owner, leaving the pot empty.

  • As more players participate under this setting, the prize pot remains empty, leaving the king with no reward at the end of the game.

Impact:

  • Players who become kings are misled to think there will be a prize at the end of the game, but end up winning nothing.

  • This breaks trust in the game, and breaks the core incentives of the game and allows the owner to extract all value from participants.

Proof of Concept

//

Recommended Mitigation

My recommeded mitigation would be to edit the isValidPercentage modifier so that they cannot put in 100%, or make the upper percentage limit to be a reasonable one. Another

- remove this code
+ add this code
++ modifier isValidPercentage(uint256 _percentage) {
require(_percentage <= 80, "Game: Percentage must be 0-80.");
_;
}
//Alternatively,
​
modifier isValidPercentage(uint256 _percentage) {
require(_percentage <= 100, "Game: Percentage must be 0-100.");
++ if(_percentage=100)
revert();
_;
}
Updates

Appeal created

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.