ScoreBoard::setPrediction
has no access control, allowing anyone to pass in any address and set predictions for them. This can be used to manipulate the game by setting predictions for other players.
The following test demonstrates that anyone can set predictions for any player. The test should revert because the player is not the one who is setting the prediction.
Add the following test to the ThePredicter.test.sol
file:
An attacker can set the predictions for other players to unlikely outcomes, reducing their chances of winning and thereby increasing their own profit.
Manual review and unit testing.
Add access control to only allow the predicter to set predictions for the player.
setPrediction has no access control and allows manipulation to Players' predictions.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.