First Flight #20: The Predicter

Summary

The makePrediction function in the ThePredicter contract allows any user to make a prediction, even if they are not approved as a player by the organizer. Additionally, it does not prevent users from setting their prediction to the default Pending value, which could be problematic.

Vulnerability Details

1. Unauthorized Prediction Submission: The function does not check if the caller is an approved player. As a result, users who have not been approved by the organizer can make predictions, violating the expected participation criteria.

2. Invalid Prediction Values: The function does not enforce that the prediction must be different from the default Pending value. This allows users to submit a prediction with the default value, which should be avoided since predictions should be actively set by players.

Code Snippet

ThePredicter.sol contract

Tool used

Manual Review

Impact

The issues in this function lead to:

• Unauthorized Predictions: Non-approved users can submit predictions, which could lead to unfair gameplay and manipulation.

• Incorrect Prediction Handling: Users can set their prediction to Pending, which should not be allowed if a prediction is being actively made. This can affect the accuracy of the prediction records and rewards distribution.

Recommendations

• Check Player Approval: Ensure that the user making the prediction is an approved player. This check should verify if the user has been approved by the organizer before allowing them to make a prediction. This can be done by using the playersStatus mapping playersStatus[msg.sender] = Status.Approved

• Validate Prediction Values: Prevent users from setting their prediction to the default Pending value prediction != ScoreBoard.Result.Pending