First Flight #6: Voting Booth

Vulnerability Details

Rewards are divided by totalVotes (where totalVotes = totalVotesFor + totalVotesAgainst) instead of totalVotesFor in https://github.com/Cyfrin/2023-12-Voting-Booth/blob/main/src/VotingBooth.sol#L192C1-L192C64 which is unintended.

Suppose 3 people voted for and 2 people voted against and the vote passes.

totalVotes = totalVotesFor + totalVotesAgainst = 3 + 2 = 5

rewardPerVoter = 1 eth / totalVotes = 1 eth / 5 = 0.2 eth

Therefore 3 voters voted for and receive 0.2 eth and hence 0.6 eth were sent out with 0.4 eth stuck in the contract. The actual amount that should be sent out to voters who voted for should be 1 eth / totalVotesFor = 1 / 3 = 0.333... eth per voter. This leads to each voter who voted for a proposal to receive lesser ETH than intended.

Impact

Loss of intended funds per voter and remaining funds to be irrevocably stuck in the contract.

Tools Used

Manual Review

Recommendations

Divide by totalVotesFor.