Submission Details
Severity:
Organizer set results should add validaiton
Summary
**As the doc shows as below, but Organizer can set the result in anytime. **
After the end of each match the Organizer will enter the match result.
Vulnerability Details
No time check, no input params check.
If Organizer random set the result in the 9th match, such as before the required time. The attacker will notice this info, if there are potential profit, he will set the results as this result to get max profit.
function setResult(uint256 matchNumber, Result result) public onlyOwner {
results[matchNumber] = result;
}
Impact
The wrong input leads to ununcessary trouble
Tools Used
Recommendations
error ThisMatchedNotEnd();
function setResult(uint256 matchNumber, Result result) public onlyOwner {
if (
block.timestamp <=
START_TIME + matchNumber * MATCH_DURATION
) {
revert ThisMatchedNotEnd();
}
results[matchNumber] = result;
}
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.