First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unregistered Players Can Call `makePrediction()`

evmninja

Summary

Function ThePredicter::makePrediction() does not prevent non-registered and non-approved players from calling it.

Vulnerability Details

Function makePrediction() does not check if the caller is a registered and approved player. This means that anyone can participate in the competition that was supposed to be available for 30 players only.

This issue can be weaponised to DOS the system by calling makePrediction() from as many addresses as possible such that function ThePredicter::withdraw() becomes too expensive to call or even cannot be completed due to out of gas.

Additionally, the non-registered and non-approved players will be eligible for shares of entrance fee they did not pay. If entrance fee is substantially higher than prediction fee, then there is a potential profit if they are able to get positive scores.

Impact

Denial of service on function ThePredicter::withdraw()

Tools Used

Testing, manual review

Recommendations

Add checks on function ThePredicter::makePrediction() such that it is callable only by registered and approved players.

Proof of Concept

The issue can be demonstrated using the following test:

function test_evmn_makePrediction_POC_unregistered() public {
​
// Try to make prediction without registration
address user = users[0];
deal(user, thePredicter.predictionFee());
​
vm.startPrank(user);
thePredicter.makePrediction{value: thePredicter.predictionFee()}(1, ScoreBoard.Result.First);
vm.stopPrank();
​
}
Updates

Lead Judging Commences

NightHawK Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

makePrediction lacks access control

makePrediction has no access controls and any unapproved user can make predictions causing an incorrect calculation and distribution of rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.