First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[M2] If there is no vote, the owner of tokenid = 0 that lists his token in the marketplace automatically wins and gets the reward.

azanux

Summary

In the function announceWinner() external onlyOwner, the variable winnerTokenId is initialized to 0. So, when nobody votes, the producer that lists tokenId = 0 automatically gets the reward of 1 health token.

Vulnerability Details

When voting is open and at the end of the period, nobody votes, the reward is given to the producer that lists the NFT with tokenid = 0.

POC

Add this function in the smart contract MartenitsaVoting and run the code:

forge test --mt testNovoteAnnounceWinner
function testNovoteAnnounceWinner() public listMartenitsa {
​
vm.warp(block.timestamp + 1 days + 1);
vm.recordLogs();
//annoncing the winner with no vote
voting.announceWinner();
​
//the winner is chasy who owned tokenId = 0 even ethere no vote
Vm.Log[] memory entries = vm.getRecordedLogs();
address winner = address(uint160(uint256(entries[0].topics[2])));
assert(winner == chasy);
}

We get the output:

Ran 1 test for test/MartenitsaVoting.t.sol:MartenitsaVoting
[PASS] testNovoteAnnounceWinner() (gas: 410532)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 7.02ms (422.92µs CPU time)

Impact

A producer that lists NFT TokenId = 0 can get a reward that he shouldn't.

Tools Used

Manual Review

Recommendations

The function announceWinner() should revert if there are no votes:

function announceWinner() external onlyOwner {
+ require(_tokenIds.length > 0 "There is no vote ");
require(block.timestamp >= startVoteTime + duration, "The voting is active");
​
uint256 winnerTokenId;
uint256 maxVotes = 0;
​
for (uint256 i = 0; i < _tokenIds.length; i++) {
if (voteCounts[_tokenIds[i]] > maxVotes) {
maxVotes = voteCounts[_tokenIds[i]];
winnerTokenId = _tokenIds[i];
}
}
​
list = _martenitsaMarketplace.getListing(winnerTokenId);
_healthToken.distributeHealthToken(list.seller, 1);
​
emit WinnerAnnounced(winnerTokenId, list.seller);
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`tokenId=0` wins the voting

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.