Submission Details
Severity:
[M-1] Vulnerability due to `block.timestamp` found in `ThePredicter::register`, `ThePredicter::makePrediction` and `ScoreBoard::setPrediction`.
Summary: Miners can manipulate the value of `block.timestamp` to their advantage. By controlling the timestamp, miners can potentially influence the outcome of time-based operations in a contract. `block.timestamp` is its potential for front-running attacks. Front-running occurs when an attacker intercepts and modifies a transaction before it is added to the blockchain.
Vulnerability Details: The parameter block.timestamp can be found in ThePredicter::register, ThePredicter::makePrediction and ScoreBoard::setPrediction functions and can be manipulated by the miners. This timestamp dependence can be exploited if the contract does not have proper checks and balances in place. Attackers can manipulate the timestamp to trick the contract into executing a function prematurely or delaying its execution, leading to unexpected results. The vulnerability can be found in the below code.
function register() public payable {
if (msg.value != entranceFee) {
revert ThePredicter__IncorrectEntranceFee();
}
if (block.timestamp > START_TIME - 14400) {
revert ThePredicter__RegistrationIsOver();
}
if (playersStatus[msg.sender] == Status.Pending) {
revert ThePredicter__CannotParticipateTwice();
}
playersStatus[msg.sender] = Status.Pending;
}
Impact: The attacker can manipulate the`block.timestamp`, they can delay or accelerate the execution of certain functions, leading to undesired outcomes.
Tools Used: Slither, Aderyn, VScode and Foundry.
Recommendations: To mitigate the risks associated with block.timestamp, the Chainlink Time-Based Upkeep job can be scheduled such that block.timestamp is extracted off-chain and hence it cannot be manipulated by miners. Another method is to use the below functions which provides a timeduration window before execution of the functions ThePredicter::register, ThePredicter::makePrediction and ScoreBoard::setPrediction. The function isExpiredchecks if the time durtion window is expred or not and only then allows the execution of the above functions.
function setTimeLock(uint256 _timeDuration) public {
require(msg.sender == organizer, "Only owner can set time lock");
_expirationBlock = block.timestamp + _timeDuration;
emit TimeLock("Timelock set for this block number");
}
function isExpired() public view returns (bool) {
return block.timestamp >= _expirationBlock;
}
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.