Submission Details
Severity:
User can re-register after being approved
Summary
The register function in ThePredicter contract only check pending status. User can register again after being approved by owner.
Vulnerability Details
In register() function, the ThePredicter__CannotParticipateTwice checking only checked the Pending status. Therefore, when approved user could register again.
function register() public payable {
...
if (playersStatus[msg.sender] == Status.Pending) {
revert ThePredicter__CannotParticipateTwice();
}
playersStatus[msg.sender] = Status.Pending;
}
Impact
The missing of checking Status.Approved can make user sign-up again after being approved to predict.
Tools Used
Manual review
Recommendations
The checking statement should be reverted when player status is Pending or Approved.
function register() public payable {
...
- if (playersStatus[msg.sender] == Status.Pending) {
+ if (playersStatus[msg.sender] == Status.Pending || playersStatus[msg.sender] == Status.Approved) {
revert ThePredicter__CannotParticipateTwice();
}
playersStatus[msg.sender] = Status.Pending;
}
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.