The value of private variables can be accessed so its possible for users to always make accurrate predictions by untrusted parties
Details
The whole system of guessing the result of the scoreboard is based on the values stored in Result[NUM_MATCHES] private results; variable. This whole system is not reliable as all blockchain data can still be viewed by the public. Since the 15 users which IVAN are inviting are not trusted they can know the state of any variable at anytime, and also ScoreBoard::setPrediction allows for users to alter their prediction without any payment so this exploit is very possible. More information on how this private data can be accessed can be found in https://solidity-by-example.org/hacks/accessing-private-data/.
Tools Used
Manual
Recommendations
Use chainlink VRF.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.