First Flight #13: Baba Marta

Summary

In voteForMartenitsa to prevent user to vote multiple times there is this requirement:
require(!hasVoted[msg.sender], "You have already voted");
This only make sure that with one address a user can vote only once, but since a use can create an infinite amount of address there is no limit to the number of vote that a user can make.

Impact

An attacker can vote as many times as he wants.

Recommendations

To mitigate this kind of attack there need to be a change in the protocol allowing to vote only to address with particular charateristics that can be validated on chain.
E.g. only an owner of at least one Martenitsa or a HealthToken can vote.