# Attacker can steal reward of actual winner by force ending the game

Attacker owning low- and high-index agents escapes all but one wounded low-index agent, instantly ending the game and claiming the grand prize meant for the real winner.

- Payout: Contest reward
- Severity: high
- Program: Looksrare
- Credited: 0xReiAyanami
- Disclosed: 2023-10-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-10-looksrare-judging/issues/98
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-looksrare%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Infiltration.sol game contract (escape/claimGrandPrize/startNewRound)
**Root cause:** Winner is determined by lowest agent index, and escaping all agents at once ends the game before the wounded low-index agent can be killed; startNewRound reverts when activeAgents==1, so the wounded agent survives and its owner claims the prize.
**Steps:**
1. Mint many low-index agents and many high-index agents as attacker; victim mints one agent with an index between them.
2. Start game; a low-index attacker agent gets wounded.
3. Call `escape(escapeIds)` listing every active agent except the wounded low-index one.
4. activeAgents becomes 1; `startNewRound()` reverts with GameOver, so the wounded agent is never killed.
5. Victim's `claimGrandPrize()` reverts NotAgentOwner; attacker calls `claimGrandPrize()` and receives the prize.
**How found:** Code reading of claimPrize (picks agents[1].agentId) and startNewRound (reverts when activeAgents==1) revealed that escaping all agents at once ends the game before wounded agents are cleared, letting a wounded low-index agent win.
**Exploitation:** Attacker pre-mints 30 low-index and 30 high-index agents around the victim's single agent, waits for one low-index agent to be wounded, then escapes all other agents in one call. Game ends with the wounded low-index agent as sole active agent; attacker claims the grand prize.
**Insight:** When a game's winner is chosen by array index rather than by survival, check whether a mass action (escape-all) can end the game before cleanup logic (startNewRound killing wounded agents) runs, leaving a wounded low-index entry as the winner.