Submission Details
Severity:
Rewards per voter not correctly computed
Summary
Rewards per voter is calculated based on the total number of voters but are distributed just to "for" voters
Vulnerability Details
Rewards are calculated based on the total number of voters:
uint256 rewardPerVoter = totalRewards / totalVotes;
But then rewards are distributed only to voters who vote "for".
There is then some remaining rewards in the contract.
Impact
If there result of the vote is 51% for, 49% of the reward will remain in the contract and won't be distirbuted.
Tools Used
Manual
Recommendations
Calculate the rewards based on the number of "For" votes instead of the total number of votes.
This can be done by replacing line 192 of the VotingBooth.sol contract :
uint256 rewardPerVoter = totalRewards / totalVotes;
by
uint256 rewardPerVoter = totalRewards / totalVotesFor;
Updates
Lead Judging Commences
0xnevi over 1 year ago
Submission Judgement Published Assigned finding tags:
VotingBooth._distributeRewards(): Incorrect computation of rewardPerVoter
Rewards breakdown
This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.