First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Users without approval by organizer and paid entry fee can make prediction on `ThePredicter::makePrediction`

0xjoaovictor

Description

Users without approval by organizer and paid entry fee can make prediction on ThePredicter::makePrediction

Impact

An stranger user that don't pay the entry fee to register and was not approved can make a prediction and play with the others approved users that paid the entry fee

Proof of Concept

Add the following code to the test/ThePredicter.test.sol:

contract ThePredicterTest is Test {
error ThePredicter__NotEligibleForWithdraw();
error ThePredicter__CannotParticipateTwice();
error ThePredicter__RegistrationIsOver();
error ThePredicter__IncorrectEntranceFee();
error ThePredicter__IncorrectPredictionFee();
error ThePredicter__AllPlacesAreTaken();
error ThePredicter__PredictionsAreClosed();
+ error ThePredicter__UnauthorizedAccess();
function test_UsersWithoutApprovalCanNotMakePrediction() public {
// setup strange user
vm.deal(stranger, 1 ether);
​
// stranger try to make prediction without registration
vm.startPrank(stranger);
vm.expectRevert({
revertData: abi.encodeWithSelector(
ThePredicter__UnauthorizedAccess.selector
)
});
thePredicter.makePrediction{value: 0.0001 ether}(
0,
ScoreBoard.Result.First
);
}

Run with: forge test --match-test test_UsersWithoutApprovalCanNotMakePrediction -vvv

Recommended Mitigation

Add the check in the ThePredicter::makePrediction:

function makePrediction(
uint256 matchNumber,
ScoreBoard.Result prediction
) public payable {
+ if (playersStatus[msg.sender] != Status.Approved) {
+ revert ThePredicter__UnauthorizedAccess();
+ }
...
Updates

Lead Judging Commences

NightHawK Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

makePrediction lacks access control

makePrediction has no access controls and any unapproved user can make predictions causing an incorrect calculation and distribution of rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.