First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

The incorrect prediction entry cutoff time causes the deadline for players to make their predictions to be much earlier than the actual scheduled cutoff time

soupy

Summary

The prediction entry cutoff time in ThePredicter::makePrediction and ScoreBoard::setPrediction was incorrectly specified resulting the deadline for players to finalize their prediction becomes much earlier than expected scheduled time

Vulnerability Details

In functions ThePredicter::makePrediction and ScoreBoard::setPrediction, there was a condition check implemented to determine if prediction valid entry timestamp was over. However, the timestamp implemented was found incorrect, resulting the prediction entry session was closed earlier than the actual intended deadline.

function setPrediction(
address player,
uint256 matchNumber,
Result result
) public {
<@@> if (block.timestamp <= START_TIME + matchNumber * 68400 - 68400)
playersPredictions[player].predictions[matchNumber] = result;
​
...
}

Since prediction cut off is 1 hour before each match start time on daily basis for continuosly 9 matches, on a full day to the next match, it is equal to
1 full day : 24 hours * 60 minutes * 60 seconds ==> 86400 unix timestamp
1 hour : 60 minutes * 60 seconds ==> 3600 unix timestamp

Therefore, the correct prediction cutoff timestamp check should be
START_TIMW + matchNumber * 86400 - 3600

Impact

Players could have miss the time to enter their predictions as the cutoff time was wrongly set and brought forward much earlier than the intended scheduled deadline, potentially cause the players to loss their rewards if their predictions indeed match the final results

Tools Used

Manual review

Recommendations

Amend the timestamp to reflect the actual schedule deadline as below

For ScoreBoard::setPrediction :

function setPrediction(
address player,
uint256 matchNumber,
Result result
) public {
- if (block.timestamp <= START_TIME + matchNumber * 68400 - 68400)
+ if (block.timestamp <= START_TIME + matchNumber * 86400 - 3600)
playersPredictions[player].predictions[matchNumber] = result;
​
playersPredictions[player].predictionsCount = 0;
​
...
}
​

For ThePredicter::makePrediction :

function makePrediction(
uint256 matchNumber,
ScoreBoard.Result prediction
) public payable {
if (msg.value != predictionFee) {
revert ThePredicter__IncorrectPredictionFee();
}
​
- if (block.timestamp > START_TIME + matchNumber * 68400 - 68400) {
+ if (block.timestamp > START_TIME + matchNumber * 86400 - 3600) {
revert ThePredicter__PredictionsAreClosed();
}
...
}
​
Updates

Lead Judging Commences

NightHawK Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Match timestamps are incorrect

In both contracts there is a similar error in the computation of the timestamps of the matches.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.