First Flight #20: The Predicter

Summary

The separation of prediction confirmation and setting in ThePredicter could lead to state inconsistencies if transactions are mined out of order.

Vulnerability Details

Potential for the prediction payment confirmation and the actual prediction setting to become out of sync.

1. Player calls makePrediction

2. confirmPredictionPayment is called and succeeds

3. The transaction fails (out of gas) before setPrediction is called

4. The payment is confirmed, but no prediction is set

Impact

Players could lose funds or have unpaid predictions counted

Recommendations

Combine these operations into a single function call.