Block.timestamp on Arbitrum works differently
Summary
This vulnerability allows malicious users to register and submit predictions after intended deadlines due to reliance on potentially manipulated block timestamps on Arbitrum.
Vulnerability Details
The contract uses block.timestamp for deadline checks-in ThePredicter::register and ThePredicter::makePrediction functions.
Malicious actors can exploit the time difference between Arbitrum and Ethereum to register or submit predictions after deadlines.
Source: Arbitrum's documentation
Impact
Users can register after the deadline
Players can submit a prediction after the organizer set the result, and guarantee a win
Tools Used
Manual review, docs
Recommendations
Decentralized Oracle: Use a reliable oracle to retrieve timestamps.
Off-chain Actions: Implement off-chain registration/prediction with proof for on-chain verification.
Lead Judging Commences
block.timestamp on Arbitrum
It would be possible to make a prediction for an ongoing or already finished match if the Arbitrum timestamps deviate according to what the Arbitrum docs states as possible.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.