First Flight #20: The Predicter

Summary

An attacker could manipulate the game outcome by strategically filling a large number of player slots.

Vulnerability Details

1. The contract allows up to 30 players.

2. Ivan and his 15 friends are guaranteed slots, leaving 14 open slots.

3. An attacker could:

   • Register 14 addresses (filling all remaining slots)

   • Use each addresses to bet on First, Draw, and Second outcomes

Impact

1. Game manipulation: The attacker is guaranteed to have multiple correct predictions for each match, regardless of the outcome.

2. Reward domination: The attacker's addresses would likely accumulate a significant portion of the total positive points, leading to a larger share of the rewards.

Tools Used

Manual code review

Recommendations

Implement KYC for non-trusted players.