First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Duplicate registration for Players with Status.Canceled in ThePredicter::register() function can re-register if they previously had Status.Pending

Caesar

Relevant GitHub Links

https://github.com/Cyfrin/2024-07-the-predicter/blob/main/src/ThePredicter.sol#L46-L60

Summary

This check verifies if a player is already in the Pending state but doesn’t consider whether the player is already in the players array as an Approved player.
If a player is registered as Approved but tries to register again, this logic won't catch it. Instead, it only checks for players in the Pending state.

if (playersStatus[msg.sender] == Status.Pending) {
revert ThePredicter__CannotParticipateTwice();
}

Vulnerability Details

ThePredicter::register() function only checks if a player’s status is Pending, allowing players who are Approved or Canceled to re-register. As we can see in:

function register() public payable {
if (msg.value != entranceFee) {
revert ThePredicter__IncorrectEntranceFee();
}
​
if (block.timestamp > START_TIME - 14400) {
revert ThePredicter__RegistrationIsOver();
}
​
@> if (playersStatus[msg.sender] == Status.Pending) {
revert ThePredicter__CannotParticipateTwice();
}
​
playersStatus[msg.sender] = Status.Pending;
}

Impact

  • Players who have been previously approved or canceled can re-register, gaining multiple entries, which undermines the fairness of the registration process.

  • Players who cancel their registration could bypass the registration check and re-register, potentially creating unintended behavior.

Tools Used

Manual

Recommendations

Update the condition to check for both Status.Pending and Status.Approved.

function register() public payable {
if (msg.value != entranceFee) {
revert ThePredicter__IncorrectEntranceFee();
}
​
if (block.timestamp > START_TIME - 14400) {
revert ThePredicter__RegistrationIsOver();
}
​
+ if (playersStatus[msg.sender] == Status.Pending || playersStatus[msg.sender] == Status.Approved) {
revert ThePredicter__CannotParticipateTwice();
}
​
playersStatus[msg.sender] = Status.Pending;
}
​
Updates

Lead Judging Commences

NightHawK Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.