OWNER CAN MANIPULATE TOURNAMENT WINNER AND STEAL ETIRE FUNDS.
Description + Impact:
The owner has full control to set any team as winner after the event ends. This allows the owner to ignore actual results and award 100% of funds (all user deposits in the ERC4626 vault) to themselves or a chosen address. Complete loss of fairness and funds for all participants.
Proof of Concept:
Users deposit tokens and bet on different teams.
Tournament ends with real results.
Owner calls the privileged function to manually set any team (or their own address) as winner.
Prize pool is distributed according to owner’s choice — honest users receive nothing.
Recommended Mitigation:
Remove owner ability to set winner manually,
OR
Use a trusted oracle (Chainlink / API3) to automatically fetch real-world.
OR
Multi-sig confirmation for winner declaration.
Appeal created
The winner is set by the owner
This is owner action and the owner is assumed to be trusted and to provide correct input arguments.
The owner can be participant
The owner is trusted.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.