First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

possibilities of matchNumber mismatch

cryptedoji

Summary

in the makeprediction function, since the matchNumber is not explicitly defined, if a player uses natural(countng) numbers to represent the matches she wants to predict, it will cause a mismatch in the scoreBoard.sol contract since matchNumbers are directly used as the array indexes of the matches they represent in the array.

Vulnerability Details

Assuming a player enters numbers ranging from 1-9 as the matchNumbers, in the scoreBoard.sol, those numbers will not correspond to the right matches in the PlayerPredictions.predictions array.

matches matchNumber array index
match-1 1 0
match-2 2 1
match-3 3 2
match-4 4 3

Impact

  • wrong predictions recorded for matches hence wrong score calculation and consequently loss of funds for players and loss of trust for the protocol

Tools Used

  • manual review

Recommendations

use enum to explicitly define the matchNumber i.e in ThePredicter.sol effect the following changes as indicated below. Then do the same thing in scoreBoard.sol but apply the modification to setPrediction and setResult function,

+enum MatchNumber{
+ match_1,
+ match_2,
+ match_3,
+ match_4,
+ match_5,
+ match_6,
+ match_7,
+ match_8,
+ match_9
+}
​
+MatchNumber matchNumber;
​
function makePrediction(
- uint256 matchNumber,
+ MatchNumber _matchNumber,
ScoreBoard.Result prediction
) public payable {
if (msg.value != predictionFee) {
revert ThePredicter__IncorrectPredictionFee();
}
+ matchNumber = _matchNumber;
if (block.timestamp > START_TIME + matchNumber * 68400 - 68400) {
revert ThePredicter__PredictionsAreClosed();
}
​
scoreBoard.confirmPredictionPayment(msg.sender, matchNumber);
scoreBoard.setPrediction(msg.sender, matchNumber, prediction);
}
​
+ import {ThePredicter} from "./ThePredicter.sol";
​
+ ThePredicter.MatchNumber matchNumber;
​
function setResult(
- uint256 matchNumber,
+ ThePredicter.MatchNumber _matchNumber, Result result
) public onlyOwner {
+ matchNumber = _matchNumber;
results[matchNumber] = result;
}
​
function setPrediction(
address player,
- uint256 matchNumber,
+ ThePredicter.MatchNumber _matchNumber,
Result result
) public {
if (block.timestamp <= START_TIME + matchNumber * 68400 - 68400)
playersPredictions[player].predictions[matchNumber] = result;
+ matchNumber = _matchNumber;
playersPredictions[player].predictionsCount = 0;
for (uint256 i = 0; i < NUM_MATCHES; ++i) {
if (
playersPredictions[player].predictions[i] != Result.Pending &&
playersPredictions[player].isPaid[i]
) ++playersPredictions[player].predictionsCount;
}
​
}
Updates

Lead Judging Commences

NightHawK Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Appeal created

cryptedoji Submitter
about 1 year ago
NightHawK Lead Judge
about 1 year ago
NightHawK Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.