First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unchecked access control in `ScoreBoard.sol::setPrediction`

vikthetilted

Summary

The setPrediction function in the ScoreBoard contract allows any use to manipulate other players' predictions for matches.

Vulnerability Details

https://github.com/Cyfrin/2024-07-the-predicter/blob/839bfa56fe0066e7f5610197a6b670c26a4c0879/src/ScoreBoard.sol#L61-L75

  • The function lacks access control, allowing any user to set predictions for any other user.

  • This can be exploited by malicious users to manipulate other players' predictions.

Impact

Unauthorized Prediction Manipulation

Consequence: Malicious users can set or alter the predictions of other players, undermining the integrity of the betting system. This can lead to disputes and loss of trust among participants, potentially causing reputational damage to the organizer.

Tools Used

Manual review

Recommendations

function setPrediction(
address player,
uint256 matchNumber,
Result result
) public {
// if (msg.sender != thePredicter || msg.sender != player) {
// revert ScoreBoard__UnauthorizedAccess();
// }
if (block.timestamp <= START_TIME + matchNumber * 68400 - 68400)
playersPredictions[player].predictions[matchNumber] = result;
​
playersPredictions[player].predictionsCount = 0;
​
for (uint256 i = 0; i < NUM_MATCHES; ++i) {
if (
playersPredictions[player].predictions[i] != Result.Pending &&
playersPredictions[player].isPaid[i]
) ++playersPredictions[player].predictionsCount;
}
}
Updates

Lead Judging Commences

NightHawK Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

setPrediction lacks access control

setPrediction has no access control and allows manipulation to Players' predictions.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.