First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`ThePredicter.sol::makePrediction` Can be called by non-approved players

coffee

Summary

The ThePredicter.sol::makePrediction function can be called by non-approved players.

Vulnerability Details

makePrediction does not have any protections in it to prevent non-approved players from making a prediciton, this means that anyone can call it.

This is also the case in the ScoreBoard.sol::setPrediction function. However, in that case the playersPredictions[player].isPaid will not be set to true because the ScoreBoard.sol::confirmPredictionPayment is not being called. This means it will have minimal protocol impact related to getting players scores and setting their predictions count.

Impact

This test passes showing that a non-approved player can make a prediction

function test_nonApprovedPlayerCanMakePrediction() public {
vm.startPrank(stranger);
vm.warp(1);
vm.deal(stranger, 1 ether);
thePredicter.register{value: 0.04 ether}();
vm.stopPrank();
​
vm.startPrank(stranger);
thePredicter.makePrediction{value: 0.0001 ether}(0, ScoreBoard.Result.Draw);
vm.stopPrank();
​
vm.startPrank(organizer);
scoreBoard.setResult(0, ScoreBoard.Result.Draw);
vm.stopPrank();
​
int8 playerScoreDraw = scoreBoard.getPlayerScore(address(stranger));
​
assertEq(playerScoreDraw, 2);
}

Tools Used

--Foundry

Recommendations

It is recommended to add protections in both the ThePredicter.sol::makePrediction and ScoreBoard.sol::setPrediction functions to prevent non-approved players from making predictions

function makePrediction(
uint256 matchNumber,
ScoreBoard.Result prediction
) public payable {
if (msg.value != predictionFee) {
revert ThePredicter__IncorrectPredictionFee();
}
​
+ if(playersStatus[msg.sender] != Status.Approved) {
+ revert ThePredicter__NonApprovedPlayer();
+ }
​
if (block.timestamp > START_TIME + matchNumber * 68400 - 68400) {
revert ThePredicter__PredictionsAreClosed();
}
​
scoreBoard.confirmPredictionPayment(msg.sender, matchNumber);
scoreBoard.setPrediction(msg.sender, matchNumber, prediction);
}
Updates

Lead Judging Commences

NightHawK Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

makePrediction lacks access control

makePrediction has no access controls and any unapproved user can make predictions causing an incorrect calculation and distribution of rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.