First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

No vote reset after `MartenitsaVoting::announceWinner`

MrCrowNFT

Summary

After the voting period is over and the winner has been announced, the voteCount carries on to the next Voting period.

Vulnerability Details

After the duration of MartenitsaVoting has been reached and MartenitsaVoting::announceWinner has been called by the owner, the voteCounts mapping is not reseted, therefor, it carries on to the next after startVoting is called. This could make the voting system irrelevant in the future, as the same tokens, will always have the upper hand.

##Proof of Code
You may add the next code to MartenitsaVoting.t to corroborate the issue:

function testNoVoteCountReset() public{
//create Martenitsa and list it for sale
vm.startPrank(jack);
martenitsaToken.createMartenitsa("bracelet");
marketplace.listMartenitsaForSale(0, 1 wei);
vm.stopPrank();
​
//start first voting period
vm.warp(block.timestamp);
voting.startVoting();
​
//vote for Martenitsa
vm.prank(bob);
voting.voteForMartenitsa(0);
vm.stopPrank();
uint256 firstVotingPeriodCount = voting.getVoteCount(0);
​
//finish first voting period and announce winner
vm.warp(block.timestamp + 1 days + 1);
vm.recordLogs();
voting.announceWinner();
​
//start second voting period
vm.warp(block.timestamp);
voting.startVoting();
uint256 SecondVotingPeriodCount = voting.getVoteCount(0);
//finish second voting period and announce winner
vm.warp(block.timestamp + 1 days + 1);
vm.recordLogs();
voting.announceWinner();
​
console2.log("Vote count for first voting period", firstVotingPeriodCount);
console2.log("Vote count for Second voting period", SecondVotingPeriodCount);
​
assertEq(firstVotingPeriodCount, SecondVotingPeriodCount);
}

Impact

Medium risk, as this issue becomes more important as more voting periods are performed, and may discourage users from voting

Tools Used

Manual review

Recommendations

You made add the next line of code at the end of MartenitsaVoting::announceWinner or a the beggining of MartenitsaVoting::startVoting

+ delete voteCounts
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.