First Flight #6: Voting Booth

Summary

There is an incorrect calculation of the amount of ETH that needs to be distributed to FOR voters.

Vulnerability Details

The rewardPerVoter is calculated using totalVotes as a divisor, which includes against voters. This is wrong, because the contract is only distributing ETH to FOR voters.

Impact

It causes some ETH to be locked in the contract if FOR voters won but there was an AGAINST voter.

Tools Used

Add the following to the VotingBoothTest.t.sol test file.

function testIfVotingForAndAgainstAllEthIsSent() public {
    vm.prank(address(0x1));
    booth.vote(true);

    vm.prank(address(0x2));
    booth.vote(true);

    vm.prank(address(0x3));
    booth.vote(false);

    console.log(address(0x1).balance);
    console.log(address(0x2).balance);
    console.log(address(0x3).balance);

    assert(!booth.isActive() && address(booth).balance == 0);
}

This test does not pass.

Recommendations

When calculating rewardPerVoter use totalVotesFor as a divisor instead of totalVotes.