BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

The winner is set manually by the owner

pacomelb

The winner is set by the owner of the contract

Description

  • The team winner should not be set by one and unique person

  • The owner can set what team he/she wants and WHEN he/she wants

// Root cause in the codebase with @> marks to highlight the relevant section
@>function setWinner(
uint256 countryIndex
) public onlyOwner returns (string memory) {

Risk

Likelihood:

  • Will occur if the owner is malicious

Impact:

  • The owner can scam participant and stole the fund

  • The owner can never set the participant and block the fund

Proof of Concept

I am a malicious owner and I set the country my friend has bet on as a winner whereas this country did not win the tournament.

Recommended Mitigation

The winner should be set by an Oracle

or

The winner should be determine by a DAO / consensus

Updates

Appeal created

bube Lead Judge 20 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

The winner is set by the owner

This is owner action and the owner is assumed to be trusted and to provide correct input arguments.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!