First Flight #6: Voting Booth

Description:
The VotingBooth::isActive function in the provided Solidity code is marked as public; however, its primary use is for internal purposes within the contract. This visibility mismatch exposes the internal state of the contract to external parties, potentially revealing information that is not intended for public scrutiny.

Impact:
The impact of this issue is relatively low since the function itself does not perform critical operations and does not directly expose sensitive data. Nevertheless, it violates the principle of encapsulation by allowing external entities to access an internal state-checking function.

Proof of Concept:
The proof of concept will demonstrate how an external contract can access the VotingBooth::isActive function inappropriately due to its public visibility. The objective is to show that external entities can query the internal state of the contract, which was not intended for public inspection.

In this proof of concept, we have a malicious external contract named MaliciousContract. This contract takes the address of a deployed VotingBooth contract in its constructor. The checkIfActive function is then used to attempt to query the internal state of the VotingBooth contract by calling its isActive function.

The VotingBooth contract, as provided in the original code, contains the isActive function marked as public. This allows external contracts, such as the MaliciousContract, to call it directly.

Execution:

1. Deploy the VotingBooth contract.

2. Deploy the MaliciousContract and provide the address of the deployed VotingBooth contract.

3. Call the checkIfActive function in the MaliciousContract.

4. Observe that the MaliciousContract can successfully query the internal state of the VotingBooth contract, violating the intended encapsulation.

This proof of concept demonstrates how the public visibility of the isActive function allows external contracts to inappropriately access the internal state of the VotingBooth contract. To mitigate this issue, it is recommended to change the visibility of the isActive function to either internal or private to prevent external access.

Recommended Mitigation:
To mitigate this issue, it is recommended to change the visibility of the VotingBooth::isActive function to either internal or private. This modification will restrict external access, aligning the function's visibility with its intended use within the contract.