First Flight #20: The Predicter
First Flight #20
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Everyone can make predictions – Players who didn't pay the entrance fee and aren't approved by the organizer can still make predictions

pob001

Summary

In ThePredicter::makePrediction, there is no restriction on any address making a prediction. This means that players who didn't pay the entrance fee and aren't approved by the organizer can make predictions.

These players can also withdraw their rewards (if they are eligible), and the withdraw function doesn't include their rewards in totalShares.

Impact

  • Users don't need to pay the entrance fee to make predictions and get rewards.

  • Users don't need to be approved by the organizer to make predictions and get rewards.

  • If the predictionFee is less than the entranceFee, users who made predictions without paying the entranceFee can block approved users from getting their rewards (because they are not included in totalShares).

Recommendations

Add a condition to the function to check if the player is approved by the organizer.

function makePrediction(
uint256 matchNumber,
ScoreBoard.Result prediction
) public payable {
+ if (playersStatus[player] != Status.Approved) {
+ revert("Player not approved by organizer");
+ }
if (msg.value != predictionFee) {
revert ThePredicter__IncorrectPredictionFee();
}
​
if (block.timestamp > START_TIME + matchNumber * 68400 - 68400) {
revert ThePredicter__PredictionsAreClosed();
}
​
scoreBoard.confirmPredictionPayment(msg.sender, matchNumber);
scoreBoard.setPrediction(msg.sender, matchNumber, prediction);
}
Updates

Lead Judging Commences

NightHawK Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

makePrediction lacks access control

makePrediction has no access controls and any unapproved user can make predictions causing an incorrect calculation and distribution of rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.