First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unfair Disqualification of Players in Reward Eligibility Check

chaossr

Summary

The isEligibleForReward function contains a logical error in its eligibility criteria, potentially disqualifying players who have made only one prediction, despite meeting the stated requirement of paying at least one prediction fee.

Vulnerability Details

The function in question is:

function isEligibleForReward(address player) public view returns (bool) {
return results[NUM_MATCHES - 1] != Result.Pending &&
playersPredictions[player].predictionsCount > 1}

The vulnerability lies in the second condition of the return statement:

playersPredictions[player].predictionsCount > 1

This condition requires players to have made more than one prediction to be eligible for a reward. However, according to the provided docs, the actual requirement is to have paid at least one prediction fee, which would correspond to making at least one prediction.

Impact
Players who have made only one prediction (and paid one prediction fee) are unfairly disqualified from receiving rewards, despite meeting the stated requirements.

Tools Used
Manual Code Review

Recommendations
1. Correct the eligibility check to align with the stated requirement:

function isEligibleForReward(address player) public view returns (bool) {
return
results[NUM_MATCHES - 1] != Result.Pending &&
playersPredictions[player].predictionsCount >= 1;
}

2. Consider adding a separate variable to track whether a player has paid the prediction fee, to make the eligibility check more explicit:

mapping(address => bool) public hasPaidPredictionFee;
​
function isEligibleForReward(address player) public view returns (bool) {
return
results[NUM_MATCHES - 1] != Result.Pending &&
hasPaidPredictionFee[player];
}
Updates

Lead Judging Commences

NightHawK Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

The eligibility criteria is wrong

Players with only one prediction cannot withdraw.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.