First Flight #20: The Predicter

Finding 3: [High] Any Address Can Make Predictions

Summary:
Only users who are approved by the organizer should be able to make predictions. However, in the current implementation, any address can call ThePredicter:makePrediction without being approved, allowing unauthorized predictions.

Vulnerability Details:
The ThePredicter:makePrediction function does not check the status of msg.sender to confirm if they are an approved player. This oversight allows any address, even those not registered or approved, to make predictions. As a result, unauthorized users can potentially make predictions, and if their predictions are correct, they can claim rewards at the end of the tournament. This can deplete the prize pool, leaving legitimate participants unable to withdraw their rightful rewards.

Proof of Concept:
A test was conducted to demonstrate the issue:

In this test, the stranger address makes predictions directly without registering, and despite not paying the entrance fee, it can withdraw rewards if their predictions are correct.

Impact:
High

Tools Used:

• Manual review

• Foundry

Recommendations:

Add the following check to ensure only approved players can make predictions:

• Add at ThePredicter: line 92:

  + if (playersStatus[msg.sender] != Status.Approved) {

  + return;

  + }