First Flight #6: Voting Booth

Summary

The VotingBoot.sol contract uses address(this).balance to calculate totalRewards. The contract creator sets ether rewards at contract creation. But an attacker could use 'selfdestruct' to forcibly send ether to the contract.

Vulnerability Details

On line 180: uint256 totalRewards = address(this).balance;

An attacker could do something like this (simplified):

`

VotingBooth booth;

constructor(VotingBooth _booth) payable {
   require(msg.value >= 100 ether);
   booth = VotingBooth(_booth);
}

function bribe() public payable {
    address payable addr = payable(address(booth));
    selfdestruct(addr);
}

`

Since the voters who vote FOR a proposal are to be paid in ether, this allows an attacker to bribe the voters with more ether to vote FOR a certain proposal when otherwise they may have voted AGAINST.

Impact

Undermines the incentives of the protocol. May result in the manipulation of voters.

Tools Used

Manual inspection.

Recommendations

Don not use address(this).balance to calculate the totalRewards.