First Flight #6: Voting Booth
First Flight #6
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Wrong calculation in VotingBooth::_distributeRewards() function leads to users getting less rewards.

pratred

Summary

The calculations for the reward distribution in the VotingBooth::_distributeRewards() is done wrong which leads to the user who have votes for getting less amount of rewards.

Vulnerability Details

In the VotingBooth::_distributeRewards() reward per user is calculated by

uint256 rewardPerVoter = totalRewards / totalVotes;

Here , totalVotes are used to calculate the rewards which means the count of voters who have voted against this proposal is also being counted in the total votes.
This leads to some amount of rewards getting sent to the voters and few stays like it is in the contract.

POC

// SPDX-License-Identifier: SEE LICENSE IN LICENSE
pragma solidity 0.8.23;
​
import {VotingBooth} from "../src/VotingBooth.sol";
import {Test, console2} from "forge-std/Test.sol";
import {_CheatCodes} from "./mocks/CheatCodes.t.sol";
import {Strings} from "@openzeppelin/contracts/utils/Strings.sol";
contract fuzzTest is Test {
VotingBooth votingBooth;
address[] voters;
receive() external payable {}
​
function testGetVoters(uint votingCount,bool[] memory vote) public {
vm.assume(votingCount <= vote.length);
vm.assume(votingCount >= 3 );
vm.assume(votingCount <= 9);
vm.assume(votingCount % 2 != 0);
​
for (uint i = 0; i < votingCount; i++) {
address add = makeAddr(Strings.toString(i));
voters.push(add);
​
}
​
console2.log(votingCount,vote.length);
assert(votingCount >= 3);
deal(address(this), 10e18);
​
votingBooth = new VotingBooth{value: 10e18}(voters);
​
for (uint i = 0; i < voters.length; i++) {
bool votingComplete = votingBooth.isActive();
if (votingComplete) {
address payable voterAddr = payable(voters[i]);
console2.log(voterAddr);
vm.prank(voterAddr);
votingBooth.vote(vote[i]);
}else{
break;
}
}
​
console2.log(address(votingBooth).balance);
assertEq(address(votingBooth).balance ,0);
}
}

Impact

User who voted for the proposal get less reward

Tools Used

Foundry,Vs code.

Recommendations

Change the calculation for the distribution of rewards in the VotingBooth::_distributeRewards() function as shown below.

- uint256 rewardPerVoter = totalRewards / totalVotes;
+ uint256 rewardPerVoter = totalRewards / totalVotesFor;
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

VotingBooth._distributeRewards(): Incorrect computation of rewardPerVoter

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.