Submission Details
Severity:
Lack of input validation for match numbers
Summary
Neither contract validates that match numbers are within the expected range (0 to NUM_MATCHES - 1).
Vulnerability Details
Functions like setResult, confirmPredictionPayment, and setPrediction accept any uint256 as a match number.
Impact
Out-of-bounds array access or storage of predictions for non-existent matches.
Recommendations
Add input validation for match numbers:
require(matchNumber < NUM_MATCHES);
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.