First Flight #6: Voting Booth

After thoroughly reviewing the contract, I can confirm that there is a reentrancy vulnerability present in the _distributeRewards() function.

The vulnerability lies in the use of the low-level _sendEth function to transfer Ether. This function is not recommended because it is possible for a recipient to perform a reentrancy attack.

A reentrancy attack is a type of security vulnerability in Ethereum smart contracts. It allows the attacker to call back into the calling function before it has finished its execution, thus "reentering" it. This can be used to manipulate the state of the contract in unexpected ways.

Here is the code snippet where the vulnerability lies:

solidity
Copy code
for (uint256 i; i < totalVotesFor; ++i) {
// if at the last voter round up to avoid leaving dust
if (i == totalVotesFor - 1) {
rewardPerVoter = Math.mulDiv(totalRewards, 1, totalVotes, Math.Rounding.Ceil);
}
_sendEth(s_votersFor[i], rewardPerVoter);
}
The attacker can potentially manipulate the _sendEth function by overriding the fallback function or implementing the receive Ether function in their contract. When the vulnerable function calls the _sendEth function, it allows the attacker to call back into the vulnerable function and execute malicious code.