First Flight #20: The Predicter

Summary

The code structure doesn't give the Players access to withdraw their rewards as the functionality is missing.

Vulnerability Details

https://github.com/Cyfrin/2024-07-the-predicter/blob/839bfa56fe0066e7f5610197a6b670c26a4c0879/src/ThePredicter.sol#L111C5-L113C59

function withdraw() public { if (!scoreBoard.isEligibleForReward(msg.sender)) { revert ThePredicter__NotEligibleForWithdraw();

Impact

Players Reward access denied

Tools Used

Manual Review

Recommendations

msg.sender should be the Player

if (msg.sender != Player) {

revert ThePredicter__NotEligibleForWithdraw();