First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unrestricted Access to Make Predictions

frontrunner

Summary

The provided code for the ThePredicter contract allows users to make predictions without verifying if they are registered players. This oversight can lead to unauthorized access and manipulation of predictions, compromising the integrity of the system.

Vulnerability Details

The function does not verify if the msg.sender is a registered and approved player before allowing them to make a prediction. It allows the function caller to make predictions despite being is unapproved.

function makePrediction(
uint256 matchNumber,
ScoreBoard.Result prediction
) public payable {
if (msg.value != predictionFee) {
revert ThePredicter__IncorrectPredictionFee();
}
//@audit -----> th documntation says predictions should stop 1 hour(7:00) before each matches
//Prediction closes after match starts.
if (block.timestamp > START_TIME + matchNumber * 68400 - 68400) {
revert ThePredicter__PredictionsAreClosed();
}
​
scoreBoard.confirmPredictionPayment(msg.sender, matchNumber);
scoreBoard.setPrediction(msg.sender, matchNumber, prediction);
}
function setPrediction(
address player,
uint256 matchNumber,
Result result
) public {
// @audit ----> Same error as the makeprediction function which does not allow player make predictions 19 hours before.
if (block.timestamp <= START_TIME + matchNumber * 68400 - 68400)
playersPredictions[player].predictions[matchNumber] = result; // @audit arbitrary user can change the prediction a user has made
playersPredictions[player].predictionsCount = 0; //
for (uint256 i = 0; i < NUM_MATCHES; ++i) {
if (
playersPredictions[player].predictions[i] != Result.Pending &&
playersPredictions[player].isPaid[i]
) ++playersPredictions[player].predictionsCount;
}
}
​

Impact

The unauthorized user can pay the prediction fee and benefit from the rewards by predicting a match correctly.

Tools Used

Recommendations

There should be a check in the ```makePredictions``` function that verifies msg.sender as a registered and approved player by the organizer.

Updates

Lead Judging Commences

NightHawK Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

makePrediction lacks access control

makePrediction has no access controls and any unapproved user can make predictions causing an incorrect calculation and distribution of rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.