# Winning agent id may be uninitialized when game is over, locking grand prize

Infiltration's agents mapping lazily sets agentId only on swaps, so the first agent's id stays 0, making claimGrandPrize revert and locking the prize.

- Payout: Contest reward
- Severity: high
- Program: Looksrare
- Credited: cergyk
- Disclosed: 2023-10-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-10-looksrare-judging/issues/31
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-looksrare%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Infiltration game contract (claimGrandPrize / agents mapping)
**Root cause:** agents[].agentId is only assigned when agents are swapped (killed/escaped); the first agent in the array is never swapped, so its agentId remains 0, an invalid id.
**Steps:**
1. Play a game where the first agent in the alive array is never swapped (never killed/escaped).
2. Game ends; agents[1].agentId == 0.
3. Call `claimGrandPrize()`; `_assertAgentOwnership(0)` reverts since no owner for id 0.
4. Prize pool remains locked.
**How found:** Code reading of the lazy initialization of the agents mapping: noticed agentId is only set during swaps, then traced claimGrandPrize's use of agents[1].agentId and the ownership check to see the zero-id revert.
**Insight:** When a struct field is lazily initialized only on mutation paths, check whether read paths (prize/ownership checks) assume it is always set; the untouched first element is a classic gap.