First Flight #6: Voting Booth

Summary

The VotingBooth::_sendEth function may revert the transaction call in the last iteration in the for-loop in VotingBooth::_distributeRewards function due to insufficient gas.

Vulnerability Details

The VotingBooth::_sendEth function attempts to execute a transaction that involves transferring funds from the contract to an address in the VotingBooth::s_votersFor array using assembly {sendStatus := call(gas(), dest, amount, 0, 0, 0, 0)};. If the contract's balance during the last transaction call is exactly equal to or less than the amount being transferred (due to previous gas fees in prior transactions draining the contract balance) and doesn’t account for gas costs, the transaction might fail due to insufficient gas coverage. Every voter except for the last voter in the array will get a successful reward payout.

Impact

Causes unfair distribution of funds to voters.

Tools Used

Recommendations