First Flight #13: Baba Marta

Summary

Once a user votes then hasVoted == true. There is no way to reset this so he can vote again.

Vulnerability Details

The inability to reset the voting session state means that the contract must be redeployed for each new voting session, leading to unnecessary costs and inefficiencies. Additionally, the persistence of state can cause confusion and errors, as old votes may incorrectly influence new voting sessions.

Impact

This could prevent the reuse of the contract for multiple voting sessions without redeployment.

Tools Used

Manual Inspection

Recommendations

Add a way to track voting in different sessions ( rounds ) .

First add an extra mapping to track votes for each voting session :

mapping(address => uint256) public lastVotedSession;
mapping(address => uint256) public votingRoundsParticipated;

then voting is :

function voteForMartenitsa(uint256 tokenId) external {
require(lastVotedSession[msg.sender] < currentSession, "You have already voted in this session");
require(block.timestamp < startVoteTime + duration, "The voting is no longer active");
require(_martenitsaMarketplace.getListing(tokenId).forSale, "You are unable to vote for this martenitsa");

lastVotedSession[msg.sender] = currentSession;
votingRoundsParticipated[msg.sender] += 1; // Increment the count of voting sessions participated
voteCounts[tokenId] += 1;

}

and startVoting is :

function startVoting() public onlyOwner {
currentSession++; // Increment the session count
startVoteTime = block.timestamp;
emit Voting(startVoteTime, duration);
}