Summary

A vulnerability was identified that allows any random user to make predictions without registering as a Player. This behavior bypasses the intended access control mechanisms

Vulnerability Details

The makePrediction function in the ThePredicter contract does not verify if the user has registered and paid the entrance fee before allowing them to make a prediction. As a result, users can exploit this vulnerability to participate in the prediction process without contributing to the prize fund, thereby receiving an unfair advantage over honest players who follow the correct registration process.

POC

Add the code above to predicter.test.sol and run with forge t --mc ThePredicterPOCTest -vvvvv to see the transaction traces.
Impact

Malicious users can repeatedly exploit this vulnerability to make predictions without financial commitment, potentially manipulating the betting outcomes and disrupting the intended operation of the protocol.

Tools Used

Manual Review / Foundry

Recommendations

Implement a check in the makePrediction function to verify if the caller has registered and paid the entrance fee before processing their prediction.