First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

`MartenitsaVoting:voteForMartenitsa` producer can vote for himself during a vote event.

vesper

Summary

MartenitsaVoting:voteForMartenitsa producer can vote for himself during a vote event. After listing any producer is able to vote for his martenitsa token.

Vulnerability Details

voteForMartenitsa function don't check if the caller is a producer as demonstrated in the test bellow just after listing his token chasy who is a producer is able to vote for his martenitsa token.

function testProducerVoteForMartenitsa() public listMartenitsa {
vm.prank(chasy);
voting.voteForMartenitsa(0);
assert(voting.hasVoted(chasy) == true);
assert(voting.voteCounts(0) == 1);
}

Impact

Vote system can be unfair because producer can vote for its creations.

Tools Used

Manuel review

Recommendations

Check if caller is a producer if yes revert the transaction, add an interface to access to isProducer and refactor the constructor of MartenitsaVoting contract

interface IMartenitsaToken {
function isProducer(address producer) external view returns (bool);
}
​
constructor(address marketplace, address healthToken, address _martenitsaToken) Ownable(msg.sender) {
_martenitsaMarketplace = MartenitsaMarketplace(marketplace);
_healthToken = HealthToken(healthToken);
martenitsaToken = IMartenitsaToken(_martenitsaToken);
}
​
/**
* @notice Function to vote for martenitsa of the sale list.
* @param tokenId The tokenId of the martenitsa.
*/
function voteForMartenitsa(uint256 tokenId) external {
require(!hasVoted[msg.sender], "You have already voted");
require(!martenitsaToken.isProducer(msg.sender), "You are producer and not eligible for voting!");
require(block.timestamp < startVoteTime + duration, "The voting is no longer active");
list = _martenitsaMarketplace.getListing(tokenId);
require(list.forSale, "You are unable to vote for this martenitsa");
​
hasVoted[msg.sender] = true;
voteCounts[tokenId] += 1;
_tokenIds.push(tokenId);
}
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Producers vote for themself

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.