Summary :-

The if condition block.timestamp <= START_TIME + matchNumber * 68400 - 68400 is incorrect in the ScoreBoard::setPrediction function, preventing timely updates to the playersPredictions mapping and prediction made by players.

Vulnerability Details :-

The incorrectly implemented if condition in ScoreBoard::setPrediction will permit players to update the prediction map at incorrect times, potentially after the match, leading to a violation of the protocol's intended functionality.

According to the contract logic, a player can only change their prediction until the match starts i.e upto 19:00:00 UTC on the day of that match. After this time, prediction changes are prohibited.

The calculation block.timestamp <= START_TIME + matchNumber * 68400 - 68400 produces an incorrect result.

Proof of Concept :-

Let's consider an example for the third match, scheduled for August 17, 2024, at 20:00:00. Players should be able to modify their predictions until this exact time.

Therefore, players will only be able to change their predictions until August 17, 2024, at 10:00:00 AM, which is incorrect.

Impact :-

Players will be unable to change their predictions, which will compromise the protocol's intended functionality, fair play and resulting in wasted prediction fees.

Tools Used :-

Manual Review

Recommendations :-

Change the condition as given below:-