First Flight #6: Voting Booth

Summary

If the vote pass, the rewards are not correctly divided and a leftover will stay in the contract

Vulnerability Details

At line 192, uint256 rewardPerVoter = totalRewards / totalVotes; should be uint256 rewardPerVoter = totalRewards / totalVotesFor;
Imagining a reward of 3 ETH, 5 allowed addresses and 3 voters (TRUE, TRUE, FALSE).
Quorum is reached (3/5) and proposition passed (2/3).
rewardPerVoter will be 3 ETH / 3 voters = 1 ETH
It will then be distributed to the list of s_votersFor consisting of 2 voters.
The last ETH will sit forever in the contract.
With the modified code, each voter would have received 1.5 ETH, leaving the contract without any ETH, as intended.

Impact

Once the distribution is completed, some of the reward is left, locked into the contract.

Tools Used

Recommendations

Fix line 192 to uint256 rewardPerVoter = totalRewards / totalVotesFor;