MEDIUM severity: User can set their answer's probability value to `uint16.max`, manipulating `result.probabilityAverage` in their favor. **Description:** In `SPBinaryPrompt.sol`, users commit an `answer` and a `probability`. When this value is revealed, the `revealReaction` function does not check if the probability exceeds 10,000 (which should be the maximum value based on how the `getScore` function uses probability).

As shown,...

Vulnerable code:
function revealReaction(
        uint256 _gameId,
        uint256 _questionId,
        bytes calldata _selection,
        uint256 salt,
        address _user
    ) external {
        (bool answer, uint16 probability) = abi.decode(_selection, (bool, uint16));
        require(
            revealedQuestions[_questionId].sessionManager == msg.sender,
            OnlySessionManager(revealedQuestions[_questionId].sessionManager, msg.sender)
        );
        Reaction storage r = reactions[_questionId][_user];
        require(r.baseReaction.timestamp != 0, AnswerNotCommitted(_user, _gameId, _questionId));
        require(!r.baseReaction.revealed, AnswerAlreadyRevealed(_user, _gameId, _questionId));
        require(
            keccak256(abi.encodePacked(_gameId, _questionId, answer, probability, salt)) == r.baseReaction.commit,
            RevealMismatch(_gameId, _questionId, answer, probability, salt, r.baseReaction.commit)
        );

        r.answer = answer;
        r.probability = probability;

        r.baseReaction.revealed = true;
        ResultAggregate storage result = resultAggregates[_questionId];
        result.respondents++;
        result.answerTotal += answer ? PRECISION : 0;
        result.probabilityTotal += probability; <-------
        result.answerAverage = result.answerTotal / result.respondents;
        result.probabilityAverage = result.probabilityTotal / result.respondents; <------
        emit AnswerRevealed(_gameId, _questionId, _user, answer, probability);
    }

function test_revealReaction_Success_full_proability() public {
        _createQuestion();

        vm.warp(block.timestamp + 100);

        bytes32 commit = keccak256(abi.encodePacked(gameId, questionId, true, int16(5000), uint256(type(uint16).max)));

        vm.prank(mockSessionManager);
        prompt.commitReaction(gameId, questionId, commit, user0);

        vm.warp(block.timestamp + 100);

        vm.prank(mockSessionManager);
        prompt.revealReaction(gameId, questionId, abi.encode(true, int16(5000)), type(uint16).max, user0);
    }

function revealReaction(
        uint256 _gameId,
        uint256 _questionId,
        bytes calldata _selection,
        uint256 salt,
        address _user
    ) external {
        (bool answer, uint16 probability) = abi.decode(_selection, (bool, uint16));
        require(
            revealedQuestions[_questionId].sessionManager == msg.sender,
            OnlySessionManager(revealedQuestions[_questionId].sessionManager, msg.sender)
        );
        Reaction storage r = reactions[_questionId][_user];
        require(r.baseReaction.timestamp != 0, AnswerNotCommitted(_user, _gameId, _questionId));
        require(!r.baseReaction.revealed, AnswerAlreadyRevealed(_user, _gameId, _questionId));
        require(
            keccak256(abi.encodePacked(_gameId, _questionId, answer, probability, salt)) == r.baseReaction.commit,
            RevealMismatch(_gameId, _questionId, answer, probability, salt, r.baseReaction.commit)
        );
+     if (probability > PRECISION ) { probability = PRECISION; }

        r.answer = answer;
        r.probability = probability;

        r.baseReaction.revealed = true;
        ResultAggregate storage result = resultAggregates[_questionId];
        result.respondents++;
        result.answerTotal += answer ? PRECISION : 0;
        result.probabilityTotal += probability;
        result.answerAverage = result.answerTotal / result.respondents;
        result.probabilityAverage = result.probabilityTotal / result.respondents;
        emit AnswerRevealed(_gameId, _questionId, _user, answer, probability);
    }