First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing access control allows anyone to set predictions for any player resulting in manipulation of the bet

EdTim

Summary

ScoreBoard::setPrediction has no access control, allowing anyone to pass in any address and set predictions for them. This can be used to manipulate the game by setting predictions for other players.

Vulnerability Details

The following test demonstrates that anyone can set predictions for any player. The test should revert because the player is not the one who is setting the prediction.

Add the following test to the ThePredicter.test.sol file:

function testAnyoneCanSetPredictionsForAPlayer() public playerRegisteredAndApproved {
address evilPlayer = makeAddr("evilPlayer");
vm.prank(evilPlayer);
// The evilPlayer sets the prediction for the stranger
scoreBoard.setPrediction(stranger, 0, ScoreBoard.Result.First);
}

Impact

An attacker can set the predictions for other players to unlikely outcomes, reducing their chances of winning and thereby increasing their own profit.

Tools Used

Manual review and unit testing.

Recommendations

Add access control to only allow the predicter to set predictions for the player.

function setPrediction(
address player,
uint256 matchNumber,
Result result
- ) public {
+ ) public onlyThePredicter {
if (block.timestamp <= START_TIME + matchNumber * 68400 - 68400)
playersPredictions[player].predictions[matchNumber] = result;
playersPredictions[player].predictionsCount = 0;
for (uint256 i = 0; i < NUM_MATCHES; ++i) {
if (
playersPredictions[player].predictions[i] != Result.Pending &&
playersPredictions[player].isPaid[i]
) ++playersPredictions[player].predictionsCount;
}
}
Updates

Lead Judging Commences

NightHawK Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

setPrediction lacks access control

setPrediction has no access control and allows manipulation to Players' predictions.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.