First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of access control in `ScoreBoard::setPrediction` causes prediction made by player can be easily altered by others

soupy

Summary

No access control on ScoreBoard::setPrediction resulting anyone can reset the prediction made by player without the player awareness

Vulnerability Details

ScoreBoard::setPrediction function is called when the Player pays the prediction fee and can be called again by the Players to alter their predictions without a second payment of the prediction fee. However, there's no access control on this function that restricts only rightful player can change their own prediction.

Proof of Concept:
Add the following test in test/ThePredicter.test.sol

function testAnyoneCanAlterPlayerPrediction() public {
address player = makeAddr("Player");
vm.deal(player, 1 ether);
​
vm.prank(player);
thePredicter.register{value: 0.04 ether}();
​
vm.prank(organizer);
thePredicter.approvePlayer(player);
​
// real player makes prediction
vm.prank(player);
thePredicter.makePrediction{value: 0.0001 ether}(0, ScoreBoard.Result.First);
​
// random stranger resets prediction made by the real player
vm.prank(stranger);
scoreBoard.setPrediction(player, 0, ScoreBoard.Result.Second);
}
​

The test will pass indicating that a stranger can easily alter the prediction made by player

Impact

Prediction made by player can be easily changed by others causing potential loss of player's reward

Tools Used

Manual review

Recommendations

Implement access control to restrict the function can only be called by rightful parties

​
+ modifier onlyThePredicterOrPlayer(address player) {
+ if (msg.sender != thePredicter && msg.sender != player) {
+ revert ScoreBoard__UnauthorizedAccess();
+ }
+ _;
+ }
​
​
function setPrediction(
address player,
uint256 matchNumber,
Result result
)
public
+ onlyThePredicterOrPlayer(player)
{...}
​
Updates

Lead Judging Commences

NightHawK Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

setPrediction lacks access control

setPrediction has no access control and allows manipulation to Players' predictions.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.