First Flight #6: Voting Booth
First Flight #6
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect calculation for `rewardPerVoter` leads to lose of funds

wafflemakr

Summary

Incorrect calculation for rewardPerVoter leads to lose of funds

Vulnerability Details

VotingBooth:_distributeRewards is a function called when totalCurrentVotes * 100 / s_totalAllowedVoters >= MIN_QUORUM, basically, when the quorum is met. If totalVotesAgainst < totalVotesFor then it calculates the rewardPerVoter by dividing totalRewards by totalVotes. Calculation is incorrect, as it should be totalVotesFor instead of totalVotes, as the contract will be trying to distribute all rewards among the total amount of voters, but it will only iterate through the s_votersFor array. Also, in VotingBooth.sol#L207, the denominator should also be totalVotesFor instead of totalVotes.

This means there will be ether left in the contract, not distributed, and the ether is lost.

PoC

function testEthLeftWhenVotingSucceeds() public {
vm.prank(address(0x1));
booth.vote(true);
​
vm.prank(address(0x3));
booth.vote(false);
​
vm.prank(address(0x4));
booth.vote(true);
​
assertTrue(!booth.isActive());
​
assertGt(address(booth).balance, 0, "VotingBooth has no Balance");
}

PoC Result

forge test --mt testEthLeftWhenVotingSucceeds
[⠒] Compiling...
No files changed, compilation skipped
​
Running 1 test for test/VotingBoothTest.t.sol:VotingBoothTest
[PASS] testEthLeftWhenVotingSucceeds() (gas: 262463)

Impact

High impact, high likelihood. Funds remaining in contract is lost.

Tools Used

  • Manual Review

  • Foundry

Recommendations

- uint256 rewardPerVoter = totalRewards / totalVotes;
+ uint256 rewardPerVoter = totalRewards / totalVotesFor;
...
- rewardPerVoter = Math.mulDiv(totalRewards, 1, totalVotes, Math.Rounding.Ceil);
+ rewardPerVoter = Math.mulDiv(totalRewards, 1, totalVotesFor, Math.Rounding.Ceil);
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

VotingBooth._distributeRewards(): Incorrect computation of rewardPerVoter

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.