First Flight #20: The Predicter

Summary

The setPrediction function in the ScoreBoard contract lacks access control, allowing any user to modify the predictions of any player. This security vulnerability can lead to unfair gameplay and manipulation of scores.

Vulnerability Details

The setPrediction function does not restrict who can update player predictions, which poses a significant risk. Unauthorized users could exploit this to alter predictions for any player, potentially impacting their scores and overall gameplay fairness.

The issue is in this function:

https://github.com/Cyfrin/2024-07-the-predicter/blob/main/src/ScoreBoard.sol#L61-L75

Any user can call the setPrediction function with any player's address and modify their predictions.
This can be exploited to change the predictions of other players, which can impact their scores and eligibility for rewards.

Impact

Allows unauthorized users to manipulate predictions of other players, which can lead to unfair advantage or loss of integrity in the prediction process.

Tools Used

Manual Review

Recommendations

Add an appropriate access modifier to this function.