Submission Details
Severity:
Players can change the prediction of the other players
Description
Players can change the prediction of the other players
Impact
A player can make a prediction of a match and other random player can change your prediction without permission
Proof Of Concept
Add the following code to the test/ThePredicter.test.sol:
function test_OnlyThePredicterAndUserAuthenticatedCanSetPredictions() public {
// setup stranger 1
vm.startPrank(stranger);
vm.deal(stranger, 1 ether);
thePredicter.register{value: 0.04 ether}();
// setup stranger 2
address stranger2 = makeAddr("stranger2");
vm.startPrank(stranger2);
vm.deal(stranger2, 1 ether);
thePredicter.register{value: 0.04 ether}();
// accept stranger 1 and stranger 2
vm.startPrank(organizer);
thePredicter.approvePlayer(stranger);
thePredicter.approvePlayer(stranger2);
// stranger 1 sets prediction
vm.startPrank(stranger);
thePredicter.makePrediction{value: 0.0001 ether}(
0,
ScoreBoard.Result.First
);
// stranger 2 try change the stranger 1 prediction
vm.startPrank(stranger2);
vm.expectRevert({
revertData: abi.encodeWithSelector(
ScoreBoard__UnauthorizedAccess.selector
)
});
scoreBoard.setPrediction(stranger, 0, ScoreBoard.Result.Second);
}
Run with: forge test --match-test test_OnlyThePredicterAndUserAuthenticatedCanSetPredictions
Recommended Mitigation
Add this check on ScoreBoard::setPrediction:
function setPrediction(
address player,
uint256 matchNumber,
Result result
) public {
+ if (msg.sender != thePredicter && msg.sender != player) {
+ revert ScoreBoard__UnauthorizedAccess();
+ }
if (block.timestamp <= START_TIME + matchNumber * 68400 - 68400)
playersPredictions[player].predictions[matchNumber] = result;
playersPredictions[player].predictionsCount = 0;
for (uint256 i = 0; i < NUM_MATCHES; ++i) {
if (
playersPredictions[player].predictions[i] != Result.Pending &&
playersPredictions[player].isPaid[i]
) ++playersPredictions[player].predictionsCount;
}
}
Updates
Lead Judging Commences
NightHawK over 1 year ago
Submission Judgement Published Assigned finding tags:
setPrediction lacks access control
setPrediction has no access control and allows manipulation to Players' predictions.
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.