Submission Details
Severity:
Wrong reward is sent to the`for` voters if the proposal has passed with any against vote
Summary
If a proposal has passed and also have 'against' votes, the reward amount is calculated wrongly and some amount is left on the contract.
Vulnerability Details
VotingBooth::_distributeRewards line 192
uint256 rewardPerVoter = totalRewards / totalVotes;
Impact
The reward amount is divided by all voters length but sent to for voters therefore for voters receive less and some amount is left on the contract.
Tools Used
update test VotingBoothTest.t:testVotePassesAndMoneyIsSent
function testVotePassesAndMoneyIsSent() public {
vm.prank(address(0x1));
- booth.vote(true);
+ booth.vote(false);
vm.prank(address(0x2));
booth.vote(true);
vm.prank(address(0x3));
booth.vote(true);
assert(!booth.isActive() && address(booth).balance == 0);
}
Recommendations
Reward calculation should be fixed
- uint256 rewardPerVoter = totalRewards / totalVotes;
+ uint256 rewardPerVoter = totalRewards / totalVotesFor;
Updates
Lead Judging Commences
0xnevi over 1 year ago
Submission Judgement Published Assigned finding tags:
VotingBooth._distributeRewards(): Incorrect computation of rewardPerVoter
Rewards breakdown
This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.