First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Player can register twice and mess up rewards

decap

Summary

Player can register twice and mess up rewards

Vulnerability Details

ThePredicter::register reverts only if playerStatus is Pending but when player is already Approved he can register again. Futhermore he can call cancelRegistration then as his status changed to Pending in second registration. He will still be in players[] array so it will mess up rewards calculation as we multiply there by players.length

Proof of code

Add this to ThePredicter.sol

function getPlayersLength() public view returns(uint256){
return players.length;
}

and this test to ThePredicter.test.sol

function test_canRegisterTwiceAndMessUpRewards() public {
vm.prank(stranger);
vm.deal(stranger, 1 ether);
thePredicter.register{value: 0.04 ether}();
​
vm.prank(organizer);
thePredicter.approvePlayer(stranger);
​
vm.startPrank(stranger);
thePredicter.register{value: 0.04 ether}();
thePredicter.cancelRegistration();
vm.stopPrank();
​
assertEq(thePredicter.getPlayersLength(), 1);
}

run command forge test --mt test_canRegisterTwice -vvv

Test will pass. User is unregistered but players array length return 1 as he is still registered in this array.

Impact

Medium, malicious user can mess up rewards distribution

Tools Used

Manual review

Recommendations

Don't allow Approved users to register

function register() public payable {
if (msg.value != entranceFee) {
revert ThePredicter__IncorrectEntranceFee();
}
​
if (block.timestamp > START_TIME - 14400) {
revert ThePredicter__RegistrationIsOver();
}
​
+ if (playersStatus[msg.sender] == Status.Pending) || (playersStatus[msg.sender] == Status.Approved){
- if (playersStatus[msg.sender] == Status.Pending) {
revert ThePredicter__CannotParticipateTwice();
}
​
playersStatus[msg.sender] = Status.Pending;
}
Updates

Lead Judging Commences

NightHawK Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.