Submission Details
Severity:
`isEligibleForReward` returns false for Players who made 1 Prediction only
Description
The contest's predefined criteria stipulates that players can receive a prize if they had paid at least one prediction fee, but the isEligibleForReward function forces players to make more than 1 prediction.
Impact
Players who participate in only one prediction won't be able to withdraw their prize.
Proof of Concept
Copy this code at the end of the existing test file, then run it :
forge test --mt test_playerShouldBeEligibleForRewardAfterOnePrediction
/**
* This test shows an error in isEligibleForReward function.
* Running this code with the original codebase will revert.
* Running this code with the appropriate value will pass.
*/
function test_playerShouldBeEligibleForRewardAfterOnePrediction() public {
vm.startPrank(stranger);
vm.deal(stranger, 1 ether);
thePredicter.register{value: 0.04 ether}();
vm.stopPrank();
vm.prank(organizer);
thePredicter.approvePlayer(stranger);
vm.prank(stranger);
thePredicter.makePrediction{value: 0.0001 ether}(1, ScoreBoard.Result.Draw);
vm.startPrank(organizer);
scoreBoard.setResult(0, ScoreBoard.Result.First);
scoreBoard.setResult(1, ScoreBoard.Result.First);
scoreBoard.setResult(2, ScoreBoard.Result.First);
scoreBoard.setResult(3, ScoreBoard.Result.First);
scoreBoard.setResult(4, ScoreBoard.Result.First);
scoreBoard.setResult(5, ScoreBoard.Result.First);
scoreBoard.setResult(6, ScoreBoard.Result.First);
scoreBoard.setResult(7, ScoreBoard.Result.First);
scoreBoard.setResult(8, ScoreBoard.Result.First);
vm.stopPrank();
vm.startPrank(organizer);
thePredicter.withdrawPredictionFees();
vm.stopPrank();
vm.startPrank(stranger);
// This reverts, while it shouldn't
vm.expectRevert(ThePredicter__NotEligibleForWithdraw.selector);
thePredicter.withdraw();
vm.stopPrank();
}
Recommended Mitigation
Update the isEligibleForReward function to authorize players with at least 1 prediction :
function isEligibleForReward(address player) public view returns (bool) {
return
results[NUM_MATCHES - 1] != Result.Pending &&
playersPredictions[player].predictionsCount > 0; // @Audit : Previously 1
}
Updates
Lead Judging Commences
NightHawK about 1 year ago
Submission Judgement Published Assigned finding tags:
The eligibility criteria is wrong
Players with only one prediction cannot withdraw.
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.