Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: medium
Valid

The time window for making predictions is wrong

Vulnerability Details

The documentation says:
"Every day from 20:00:00 UTC one match is played. Until 19:00:00 UTC on the day of the match, predictions can be made by any approved Player."

However, the ThePredicter::makePrediction function checks the prediction time window like this:
if (block.timestamp > START_TIME + matchNumber * 68400 - 68400) {
revert ThePredicter__PredictionsAreClosed();
}

I guess the intention here is to make it 1 hour before the match start time. In that case there are multiple flaws here:

  1. 68400 that matchNumber is multiplied with is 19 hours and not 24 hours

  2. The 68400 that it subtracts with, should be 1 hour

Impact

Happens often, but low impact

Tools Used

Code inspection

Recommendations

Change the code that checks the date to:

+ * uint256 oneDayInSeconds = 86400
+ * uint256 oneHourInSeconds = 3600
+ * if (block.timestamp > START_TIME + matchNumber * oneDayInSeconds - oneHourInSeconds) {
- * if (block.timestamp > START_TIME + matchNumber * 68400 - 68400) {
revert ThePredicter__PredictionsAreClosed();
}

This way, if it is for example the 2nd match, which would be matchNumber=1... It would lead to 23 hours after Thu Aug 15 2024 20:00:00, which is Thu Aug 16 2024 19:00:00.

Updates

Lead Judging Commences

NightHawK Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Match timestamps are incorrect

In both contracts there is a similar error in the computation of the timestamps of the matches.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.