Submission Details
Severity:
Players can make prediction with matchNumber out of the range of matches on ScoreBoard::setPrediction
Description
Players can make prediction with matchNumber out of the range of matches on ScoreBoard::setPrediction
Impact
A player can edit with wrong match number and not having the chance to earn
Proof Of Concept
In the test/ThePredicter.test.sol add the new error:
error ScoreBoard__UnauthorizedAccess();
+ error ScoreBoard__IncorrectMatch();
And add the test:
function test_PlayerCanOnlyPlayTheMatchesInTheRangeOnSetPrediction() public {
// setup stranger
vm.startPrank(stranger);
vm.deal(stranger, 1 ether);
thePredicter.register{value: 0.04 ether}();
vm.stopPrank();
// accept stranger
vm.startPrank(organizer);
thePredicter.approvePlayer(stranger);
vm.stopPrank();
// try to play match out of the range
vm.expectRevert(
abi.encodeWithSelector(
ScoreBoard__IncorrectMatch.selector
)
);
vm.startPrank(stranger);
scoreBoard.setPrediction(stranger, 10, ScoreBoard.Result.Second);
vm.stopPrank();
}
Run with: forge test --match-test test_PlayerCanOnlyPlayTheMatchesInTheRangeOnSetPrediction
Recommended Mitigation
Add the new error on src/ScoreBoard.sol:
error ScoreBoard__UnauthorizedAccess();
+ error ScoreBoard__IncorrectMatch();
Add the new variable to control de number of the matches:
And add the check on setPrediction:
function setPrediction(
address player,
uint256 matchNumber,
Result result
) public {
+ if (matchNumber >= NUM_MATCHES) {
+ revert ScoreBoard__IncorrectMatch();
+ }
if (block.timestamp <= START_TIME + matchNumber * 68400 - 68400)
playersPredictions[player].predictions[matchNumber] = result;
playersPredictions[player].predictionsCount = 0;
for (uint256 i = 0; i < NUM_MATCHES; ++i) {
if (
playersPredictions[player].predictions[i] != Result.Pending &&
playersPredictions[player].isPaid[i]
) ++playersPredictions[player].predictionsCount;
}
}
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.