kgothatso - `YoloV2 :: cancelAfterRandomnessRequest` the function can be called by anyone to cancel a found and cause a DOS attack

[sherlock-admin2]

kgothatso

high

YoloV2 :: cancelAfterRandomnessRequest the function can be called by anyone to cancel a found and cause a DOS attack

Summary

the is no access control on the cancelAfterRandomnessRequest function

Vulnerability Detail

attacker can check if he/she is not a winner and just cancel the round before the withdraw

Impact

attacker can cancel until they win

Code Snippet

https://github.com/sherlock-audit/2024-01-looksrare/blob/main/contracts-yolo/contracts/YoloV2.sol#L421

Tool used

Manual Review

Recommendation

add a function modifier to the cancelAfterRandomnessRequestfunction .

Duplicate of #12