First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Every use can make predictions in `ThePredicter.sol::makePrediction`

vikthetilted

Summary

The makePrediction function in the ThePredicter contract allows players to make predictions for matches. However, it has a vulnerability due to the lack of access control, allowing unauthorized users to make predictions.

Vulnerability Details

https://github.com/Cyfrin/2024-07-the-predicter/blob/839bfa56fe0066e7f5610197a6b670c26a4c0879/src/ThePredicter.sol#L85-L99

Lack of Access Control:

  • The function does not verify if the caller is an approved player before allowing them to make a prediction.

  • This can be exploited by unauthorized users to participate in the betting process.

Impact

Unauthorized users can make predictions, which undermines the integrity of the betting system. This can lead to disputes and loss of trust among participants, potentially causing reputational damage to the organizer.

Tools Used

Manual review

Recommendations

function makePrediction(
uint256 matchNumber,
ScoreBoard.Result prediction
) public payable {
​
+ if (playersStatus[msg.sender] != Status.Approved) {
+ revert ThePredicter__UnauthorizedAccess();
+ }
​
if (msg.value != predictionFee) {
revert ThePredicter__IncorrectPredictionFee();
}
​
// Ensure the prediction is made before the match starts
if (block.timestamp > START_TIME + matchNumber * 86400 - 3600) {
revert ThePredicter__PredictionsAreClosed();
}
​
scoreBoard.confirmPredictionPayment(msg.sender, matchNumber);
scoreBoard.setPrediction(msg.sender, matchNumber, prediction);
}
​
Updates

Lead Judging Commences

NightHawK Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

makePrediction lacks access control

makePrediction has no access controls and any unapproved user can make predictions causing an incorrect calculation and distribution of rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.