Summary

The voting mechanism implemented determines the output of a vote as soon as the quorum is reached. With this approach, only the first votes up to the quorum threshold have meaning for the output of the poll. If everyone of the allowed voters wishes to vote, they will have to force their transactions among the first votes, or whatever preference they expressed will not matter to the overall result. In order to be selected among the first voters, they will have to pay higher gas fees, meaning the result of the vote is strongly correlated to the wealth and amount of money each voter has, instead of the real reflection of the will of the voting pool.

Vulnerability Details

The comments in the VotingBooth.sol::votefunction state:

As clearly stated by my comment marked with the keyword @auditor, the example scenario shows the main flaw of this voting mechanism: if voters do not outbid each other on gas fees, the result of the vote can be completely different from the actual reflection of the will of the voters.
To represent the issue more schematically, let's consider the example discussed in the provided comments:

• five voters are allowed to vote;

• with the quorum set at 51%, this means that after the third vote is cast, the remaining two votes are irrelevant, as the result of the poll is computed and the opportunity to vote is de-activated;

• all users wishing to vote have to make sure they are picked in the next block, and before - at least - two of the other voters, or their preference will not matter;

• to make sure their transaction is inserted before other voters, they must be willing to pay higher gas fees;

• users capable of spending more can determine the output of the poll, even if their preference does not match the actual majority.

Impact

A smaller group of voters with larger financial possibilities can determine the result of the entire poll, if they represent the majority of the preferences when the vote counter reaches the quorum.

Tools Used

Manual review, VSCode

Recommendations

Implementing a minimum time threshold to allow everyone to vote represents a potential fix to the issue.
The mechanism of determining the result after the quorum is reached can be maintained, but only if a reasonable amount of time to vote is guaranteed: this way, all users willing to vote can manage to express their preference and determine the result of the poll.