First Flight #20: The Predicter

Summary

The prediction deadline check in ThePredicter::makePrediction function is incorrectly implemented, leading to incorrect prediction windows for all matches.

Vulnerability Details

The README.md file specifies:

"The start of the tournament is set to Thu Aug 15 2024 20:00:00 UTC. A total of 9 matches will be played."

"Every day from 20:00:00 UTC one match is played. Until 19:00:00 UTC on the day of the match, predictions can be made by any approved Player. Players pay prediction fee when making their first prediction for each match."

However, the current implementation uses the following check:

This implementation creates a window of approximately 19 hours between each match (68400 seconds), which is incorrect. It fails to align with the daily match schedule and the intended prediction deadline.

This results in the following incorrect prediction deadlines for matchNumber 0 to 8:

August 15, 2024, at 01:00 (1:00 AM)

August 15, 2024, at 20:00 (8:00 PM)

August 16, 2024, at 15:00 (3:00 PM)

August 17, 2024, at 10:00 (10:00 AM)

August 18, 2024, at 05:00 (5:00 AM)

August 19, 2024, at 00:00 (Midnight)

August 19, 2024, at 19:00 (7:00 PM)

August 20, 2024, at 14:00 (2:00 PM)

August 21, 2024, at 09:00 (9:00 AM)

Impact

Players are unable to make predictions within the intended timeframe, disrupting the fairness and integrity of the tournament.

Tools Used

Manual Review

Recommendations

A more accurate implementation would involve:

1. Using 86400 seconds (24 hours) as the interval between matches.

2. Adjusting the deadline to be 1 hour before the match start time.

The corrected implementation should be:

This ensures:

• Matches occur daily at 20:00 UTC

• Predictions close at 19:00 UTC each day

• The prediction window aligns correctly with the 9-day tournament structure

Additionally, consider implementing a constant for SECONDS_PER_DAY (86400) and PREDICTION_WINDOW_CLOSE (3600) to improve code readability and maintainability.