Submission Details
Severity:
selectWinner() is not ownable, prone to manipulations
Summary
selectWinner() can be called by anyone.
Vulnerability Details
As anyone can call selectWinner() and because of the issues with random number generation it's possible to manipulate with the list of players. The the attacker could add addresses until (one of) his addresses will have the winnerIndex. After that the attacker could call selectWinner() and take funds.
Impact
High. Allows to easily commit fraud.
Tools Used
Manual check.
Recommendations
Use
onlyOwnermodifier.Use verified source of randomness, e.g. Chainlink VRF.
Updates
Lead Judging Commences
Hamiltonite almost 2 years ago
Submission Judgement Published Reason: User experience and design improvement
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.