First Flight #20: The Predicter

Summary

The setPrediction function in ScoreBoard.sol is publicly accessible, allowing anyone to make predictions without proper authorization or payment.

Vulnerability Details

The setPrediction function lacks access control modifiers and is declared as public. This allows any external actor to call the function directly, bypassing the intended flow of registration, approval, and fee payment implemented in ThePredicter.sol contract.

Impact

This vulnerability undermines the entire prediction system:

1. Unauthorized users can make predictions without registration or approval.

2. The protocol loses revenue from unpaid entrance and prediction fees.

3. The integrity of the prediction contest is compromised.

4. Malicious actors could manipulate the scoring system.

Tools Used

Manual review

Recommendations

Add an onlyPredicter modifier to the setPrediction function in ScoreBoard.sol.