Stuck ethereum on contract due to reward calculation error
Summary
In any scenario where a quorum is reached and there are more votes in favour than against, less ETH will be sent from the contract than there is in the contract balance.
Vulnerability Details
Conditions:
Quorum is reached;
totalVotesFor greater than totalVotesAgainst.
totalVotesAgainst greater than 0
Impact
The contract will always have an ETH balance that cannot be withdrawn.
The amount of stuck ETH depends on the number of votes against and can be defined:
stuck ETH = rewardPerVoter * totalVotesAgainst
Recommendations
Change the calculation of rewardPerVoter (link)
or add a "skim" function that sends the "dust" of ETH to the s_creator.
Lead Judging Commences
VotingBooth._distributeRewards(): Incorrect computation of rewardPerVoter
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.