Submission Details
Severity:
Rewards calculation is wrong
Summary
Rewards are divided by the total number of votes, instead of the number for votes.
Vulnerability Details
rewardPerVoter is set to totalRewards / totalVotes. When totalVotesFor is less than totalVotes, ie. when voting is not unanimous, then rewardPerVoter will be lower than expected causing funds to be left in the contract.
Impact
Voters would be underpaid.
Funds would be lost, as they are left in the contract without option to remove them.
Tools Used
forge test
Failing spec for confirmation:
function testIfVoteIsNotUnanimousAllMoneyIsSent() public {
uint256 startingAmount = address(this).balance;
vm.prank(address(0x1));
booth.vote(false);
vm.prank(address(0x2));
booth.vote(true);
vm.prank(address(0x3));
booth.vote(true);
assert(address(booth).balance == 0);
}
Recommendations
Change totalVotes to totalVotesFor in both reward calculations, lines 192 and 207.
Updates
Lead Judging Commences
0xnevi over 1 year ago
Submission Judgement Published Assigned finding tags:
VotingBooth._distributeRewards(): Incorrect computation of rewardPerVoter
Rewards breakdown
This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.