First Flight #20: The Predicter

Summary

The withdrawPredictionFees function in the ThePredicter contract allows the organizer to withdraw the balance of the contract, including entrance fees paid by users who are not yet approved as players. This can lead to unauthorized withdrawal of funds that should be refundable to non-approved users.

Vulnerability Details

The withdrawPredictionFees function calculates the withdrawable amount by subtracting the total entrance fees for approved players from the contract balance:uint256 fees = address(this).balance - players.length * entranceFee;

However, this calculation does not consider that Users who have paid the entrance fee but have not been approved as players are entitled to a refund if they cancel their registration. The current implementation does not account for these refunds, potentially allowing the organizer to withdraw these fees improperly.

Code Snippet

ThePredicter.sol contract

Tool used

Manual Review

Impact

The issues in this function lead to:

• Unauthorized Withdrawal: The organizer could withdraw entrance fees paid by users who are not yet approved as players, violating the intended refund policy.

• Financial Mismanagement: Without accurate tracking of entrance fees and refunds, the contract could mismanage funds, leading to unfair treatment of users and potential financial loss.

Recommendations

• Track Total Entrance Fees: Introduce a variable to keep track of the total entrance fees collected. This should be updated with each registration and adjusted when a registration is canceled.

• Implement Refund Tracking: Maintain a record of entrance fees for each user and adjust the total refundable amount accordingly. This ensures that only the correct amount of prediction fees can be withdrawn, and entrance fees for non-approved users can be refunded if needed.

• Update Withdraw Logic: Modify the withdrawPredictionFees function to account for entrance fees of non-approved players, ensuring that these funds are not incorrectly included in the withdrawable amount.