First Flight #13: Baba Marta

Summary

The MartenitsaVoting:: _tokenIds array length is increased for every vote and is completely iterated when the owner calls MartenitsaVoting::announceWinner this fact can be exploited by a malicious user to drastically increase _tokenId array length .

Impact

It can cost owner a lot of gas when he calls MartenitsaVoting::announceWinner function.

Proof of Code

1. The MartenitsaVoting::voteForMartenitsa function has the following line of code _tokenIds.push(tokenId); which pushes every token id into the _tokenIds array which drastically increases the array length

2. When the owner calls MartenitsaVoting::announceWinner the code reaches the following line of code
   for (uint256 i = 0; i < _tokenIds.length; i++) where the whole length of _tokenIds array length is iterated

3. Malicious user can Vote through multiple addresses to increase this array length resulting in a gas grief attack for the owner

Recommendations

In the MartenitsaVoting::voteForMartenitsa checking for token id before pushing it will solve the issue ,make the following changes to MartenitsaVoting::voteForMartenitsa

Since ids to which users can vote belong to trusted producers and are limited there is no risk of an increased array length or high gas cost.