Summary

Funds can be locked in the VotingBooth contract due to wrong logic for Reward Distribution in _distributeRewards function.

Vulnerability Details

VotingBooth contract is a one-time use smart contract in which funds can only be withdrawn via Reward Distribution in _distributeRewards function.
Due to this, after the voting is over, funds left inside the contract can never be recovered.

One such case depicting the vulnerability - When 4 voters votes in favor of the proposal and wins the proposal. Reward/funds in contract is 10 ether. This case will cause the first 3 voters to get 2 ethers each and last voter will get 3 ether. Total comes out to be 9 ether and 1 ether is left in the contract with no way to recover it.

Impact

Funds are locked in the contract with no way to recover them.

Tools Used

Manual Review

Recommendations