[H-1] Incorrect timestamp validation logic in ThePredicter::makePrediction and ScoreBoard::setPrediction, leading to a potential Denial of Service (DoS) attack.

Description:

The ThePredicter::makePrediction and ScoreBoard::setPrediction functions are designed to be executed within a specific time frame: until 19:00:00 UTC on the day of the match. However, the current implementation uses incorrect timestamp validation logic. The affected implementations are shown below:

Proof of Concept:

As described in the contest documentation, there are a total of 9 matches to be played, starting on Thu Aug 15 2024 20:00:00 UTC. Every day from 20:00:00 UTC one match is played. Until 19:00:00 UTC on the day of the match, predictions can be made. This data can be used to check the logic of the if statement in ThePredicter::makePrediction:

Below is a verification of the logic with actual values:

The result of this test shows that the logic behind the calculation of the correct time for the predictions to be made is faulty. In fact, it goes so far that for the last game the prediction threshold is Thu Aug 22 2024 04:00:00and not Fri Aug 23 2024 19:00:00.

Impact:

Players will no longer be able to make their predictions by 19:00 on a daily basis and will not be able to pay the prediction fees. As a result, the protocol will lose a significant amount of prediction fees.
Likelihood: High / Impact: High, resulting in an overall risk level of High.

Tools Used:

VSCode, manual review

Recommended Mitigation:

Consider using this improved logic for the if statement in ThePredicter::makePrediction:

The improved logic for the if statement in ScoreBoard::setPrediction would be as follows: