First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of Access Control in ThePredicter::makePrediction Function leading to Access it by anyone

chaossr

Summary

The makePrediction function in the ThePredicter contract lacks proper access control. It allows any address to submit predictions, whereas only approved players should have this ability.

Vulnerability Details

function makePrediction(
uint256 matchNumber,
ScoreBoard.Result prediction
) public payable {
if (msg.value != predictionFee) {
revert ThePredicter__IncorrectPredictionFee();
}
​
if (block.timestamp > START_TIME + matchNumber * 68400 - 68400) {
revert ThePredicter__PredictionsAreClosed();
}
​
scoreBoard.confirmPredictionPayment(msg.sender, matchNumber);
scoreBoard.setPrediction(msg.sender, matchNumber, prediction);
}

The vulnerability arises because:

  1. The function is public and lacks any checks to verify if the caller is an approved player.

  2. Anyone can call this function and make predictions, as long as they pay the correct prediction fee.

Impact


Unfair Advantage: Malicious actors could create multiple addresses to submit numerous predictions, increasing their chances of winning unfairly.
Financial Risk: The contract could accumulate fees from unapproved players, potentially leading to issues with reward distribution.

Tools Used

Manual Code Review

Recommendations

Implement a check to ensure only approved players can make predictions:

function makePrediction(
uint256 matchNumber,
ScoreBoard.Result prediction
) public payable {
require(playersStatus[msg.sender] == Status.Approved, "ThePredicter: Player not approved");
// ... rest of the function ...
}
Updates

Lead Judging Commences

NightHawK Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

makePrediction lacks access control

makePrediction has no access controls and any unapproved user can make predictions causing an incorrect calculation and distribution of rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.