First Flight #20: The Predicter

Summary

Since the code prevents users from withdrawing their money until the 9th match result is set users reward could be stuck for an extended period

Vulnerability Details

• Players register

• get approved by users

• make prediction from day 1 to 9

• organizer set result for day 1 to 8

• but for some reason the match for day 9 was postponed (this could happen for any reason, like weather, fans pitch invasion, schedule clash).

• When players call withdraw() ThePredicter.sol contract makes a call to isEligibleToReward function in ScoreBoard.sol this checks if the result for the 9th match is set, since it hasn't been set withdraw function reverts.

Users will not be able to get their rewards until the result for the 9th match is finally set.

Impact

Players reward could be stuck for an extended period of time

Tools Used

Manual Code Review

Recommendations

isEligibleToReward function is checking if result is set for the 9th it should propably be set to use the date the 9th match is supposed to be played