First Flight #6: Voting Booth
First Flight #6
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Total balance of the contract is distributed or refunded

y0ng0p3

Summary

Vulnerability Details

Total balance of the contract is distributed or refunded, including funds provided from other sources than the creator at the deployment of the contract.
If the VotingBooth contract receives ethers from other sources (by a transfer), those funds will be distributed to For voters instead of the initial funds the creator provided at the deployment of the contract.

Impact

Contract owned funds are distributed amongs For voters. Loss of funds.

Tools Used

Manual review

Recommendations

Store on chain totalRewards, the amount of ethers the creator sended at deployment. Send this exact amount to For voters and send the rest to the creator after the for loop.

File: src/VotingBooth.sol
​
47: uint256 private constant MIN_QUORUM = 51;
+ 48: uint256 immutable totalRewards;
​
116: s_creator = msg.sender;
+ 117: totalRewards = msg.value;
​
- 185: uint256 totalRewards = address(this).balance;
+ 211: _sendEth(s_creator, address(this).balance);
Updates

Lead Judging Commences

0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.