Submission Details
Severity:
Arbitrary ETH send in ``withdraw`` function
Summary
The withdraw function in ThePredicter contract allows sending ETH to an arbitrary address (the caller) without sufficient checks.
Vulnerability Details
In the withdraw function:
function withdraw() public {
// ...
if (reward > 0) {
scoreBoard.clearPredictionsCount(msg.sender);
(bool success, ) = msg.sender.call{value: reward}("");
require(success, "Failed to withdraw");
}
}
The function sends ETH to msg.sender without verifying if the caller is still an approved player.
Impact
While there are checks for eligibility and reward calculation, a player who was approved but later removed (like for another match) could still withdraw funds.
Tools Used
Manual code review
Recommendations
Add an additional check to ensure the caller is still an approved player:
require(playersStatus[msg.sender] == Status.Approved, "Not approved");
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.