Submission Details
Severity:
Lack of access control in `setPrediction` function
Summary
The setPrediction function can be called by any address, not just the ThePredicter contract, allowing unauthorized prediction settings.
Vulnerability Details
The setPrediction function is public and lacks any access control modifier, meaning any external actor can call this function and set predictions for any player.
Impact
Malicious actors can set or change predictions for other players, manipulating the game outcomes.
Tools Used
Manual code review
Recommendations
Add the onlyThePredicter modifier to the setPrediction function:
function setPrediction(
address player,
uint256 matchNumber,
Result result
) public onlyThePredicter {
// ...
}
Updates
Lead Judging Commences
NightHawK 11 months ago
Submission Judgement Published Assigned finding tags:
setPrediction lacks access control
setPrediction has no access control and allows manipulation to Players' predictions.
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.