Summary

makePrediction(), which does not check if the player is registered and approved before allowing them to make a prediction, and coul lead to unregistered or unapproved users being able to manipulate the system and withdraw rewards.

Vulnerability Details

Impact

It appears that stranger did not pay the entrancefee but was able to withdraw an amount equivalent to the entrance fee along with their initial balance.

Potential Exploit Scenario
An unapproved user calls makePrediction with the correct msg.value.
The prediction is accepted, and playersPredictions[player].predictionsCount is incremented.
The unapproved user meets the criteria for rewards (e.g., making more than one prediction).
The unapproved user calls withdraw and receives a portion of the rewards, even though they are not in the players array.

stranger calls the withdraw function and receives the entrance fee (0.04 ether) back due to the contract logic where maxScore is less than 0.

Tools Used

Recommendations

The contract does not check if the user has paid the entrance fee before allowing them to withdraw. The logic in the withdraw function only checks if the user is eligible for a reward based on their predictions and scores but does not verify if they are an approved player.

Hence modifying the logic in the withdraw function to check if user paid entrancefee()