Submission Details
Severity:
`block.timestamp` used in setting deadline can be manipulate by the miner
## Summary
`block.timestamp` used in setting deadline can be manipulate by the miner
## Vulnerability Details
The `makePrediction` function is designed to allow users to make predictions for a match, provided the prediction is submitted before a certain deadline. The deadline is calculated based on this formula `(block.timestamp > START_TIME + matchNumber * 68400 - 68400` so the miner can manipulate the deadline slightly which allow him to make a prediction after the result is shown.
+ PoC use the code in (`ThePredicter.test.sol`)
<details>
```js
function test_ManipulatingTimeStampLeadingTomakeAPredictionAfterDeadline() public {
// 1. Player is Registering
vm.startPrank(stranger);
vm.warp(1);
vm.deal(stranger, 1 ether);
thePredicter.register{value: 0.04 ether}();
vm.stopPrank();
//2. Organizer is approving the player
vm.startPrank(organizer);
vm.warp(2);
thePredicter.approvePlayer(stranger);
vm.stopPrank();
//3. Manipultaing timestamp as we are the miner
vm.warp(1723820399); // Condition = block.timestamp < 1723820400
vm.startPrank(organizer);
scoreBoard.setResult(2, ScoreBoard.Result.First);
vm.stopPrank();
// 4.making prediction after the result is shown by manipulating time.stamp
vm.startPrank(stranger);
thePredicter.makePrediction{value: 0.0001 ether}(2, ScoreBoard.Result.First);
vm.stopPrank();
assertEq(scoreBoard.getPlayerScore(stranger),2);
}
```
</details>
## Impact
By manipulating the timestamp, a user can make predictions after the official deadline. This can be exploited to:
1. Make predictions after seeing results: Users can make informed predictions based on known outcomes, defeating the purpose of predictions.
2. Compromise fairness: The integrity of the prediction system is compromised, leading to unfair advantages and potential financial losses for other users.
3. Financial Loss
Allowing predictions after the deadline can result in significant financial losses for other participants and the system itself, as it enables a user to always predict correctly after seeing the result.
## Tools Used
Manual Review
## Recommendations
+ Use oracle to get time
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.