Submission Details
Severity:
Block.timestamp allows the miner to extend up to 15 seconds, or shorten the start of the match
Summary
Block.timestamp is a variable that is a vulnerability for users, and an item for miners. it allows you to shorten or lengthen the miner's block time. This is dangerous for users because the miner can prolong the start of the match, meaning users will have to wait longer
Vulnerability Detail
The variable has 2 features, 1 feature is dispersion (time spread up to 15 seconds), 2 that the miner can extend or shorten the block time.
if (block.timestamp <= START_TIME + matchNumber * 68400 - 68400)
playersPredictions[player].predictions[matchNumber] = result;
Impact
this may affect the outcome of the match. since in logic there should be matchNumber * 68400 - 68400), in analysis, and if you shorten or lengthen the number from 68400 it may change to 68415, this will lead to damage for users
Tools Used
VSCODE
Recommendations
Add an external time oracle that will work specifically for block.timestamp
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.