First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

MartenitsaVoting::announceWinner does not account for MartenitsaTokens with equal votes

josh4324

Summary

The MartenitsaVoting::announceWinner function has a vulnerability where it does not properly handle the case when multiple MartenitsaTokens have an equal number of votes. The function is only accurate when one of the MartenitsaTokens has a strictly higher number of votes compared to the others.

Vulnerability Details

The MartenitsaVoting::announceWinner function is designed to determine the winning MartenitsaToken based on the number of votes each token has received. However, the current implementation does not consider the scenario where two or more tokens have the same number of votes.

In the case of a tie, the function will arbitrarily select one of the tokens with the highest vote count as the winner, rather than properly handling the tie situation. This can lead to inconsistent and unfair results, as the true winner may not be accurately determined.

function announceWinner() external onlyOwner {
require(block.timestamp >= startVoteTime + duration, "The voting is active");
​
uint256 winnerTokenId;
uint256 maxVotes = 0;
​
for (uint256 i = 0; i < _tokenIds.length; i++) {
if (voteCounts[_tokenIds[i]] > maxVotes) {
@> maxVotes = voteCounts[_tokenIds[i]];
@> winnerTokenId = _tokenIds[i];
}
}
​
list = _martenitsaMarketplace.getListing(winnerTokenId);
_healthToken.distributeHealthToken(list.seller, 1);
​
emit WinnerAnnounced(winnerTokenId, list.seller);
}
​

Impact

The vulnerability in the MartenitsaVoting::announceWinner function can have the following impacts:

  1. Incorrect Winner Selection: In the event of a tie, the function may select a winner arbitrarily, leading to an incorrect or unfair outcome. This can undermine the integrity and fairness of the voting process.

  2. Loss of Trust: If users become aware of the vulnerability and the potential for incorrect winner selection, it can erode trust in the voting system. Users may question the reliability and accuracy of the results, leading to a loss of confidence in the platform.

Tools Used

Manual Review

Recommendations

Add a check for equal number of votes to the announceWinner()

function announceWinner() external onlyOwner {
require(block.timestamp >= startVoteTime + duration, "The voting is active");
​
uint256 winnerTokenId;
uint256 maxVotes = 0;
+ uint256 countEqualVotes = 0;
​
for (uint256 i = 0; i < _tokenIds.length; i++) {
if (voteCounts[_tokenIds[i]] > maxVotes) {
maxVotes = voteCounts[_tokenIds[i]];
winnerTokenId = _tokenIds[i];
+ countEqualVotes = 0; // Reset count if a new winner with more votes is found
+ } else if (voteCounts[_tokenIds[i]] == maxVotes) {
+ countEqualVotes++; // Increment count for equal votes
}
}
​
+ require(countEqualVotes == 0, "There are tokens with equal votes");
​
list = _martenitsaMarketplace.getListing(winnerTokenId);
_healthToken.distributeHealthToken(list.seller, 1);
​
emit WinnerAnnounced(winnerTokenId, list.seller);
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Tie in voting is not considered

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.