First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

The voting period can be extended or restarted by calling `MartenitsaVoting::startVoting` more than one time

0xlouistsai

Summary

The voting duration is one day and it should only occur once, as outlined in the documentation, but the protocol owner might accidentally or maliciously called MartenitsaVoting::startVoting for more than one time, thus extending the voting period for more than one day.

Vulnerability Details

There is no validation in MartenitsaVoting::startVoting, allowing it to be called multiple times. If the protocol owner initiates voting at block.timestamp, intending it to end at block.timestamp + 1 day, a mistake or malicious action could occur if the function is called before the voting period ends. This would reset the voting period's end time to the current timestamp plus an additional day, effectively extending the voting duration. Furthermore, the protocol owner has the ability to initiate a new voting event, contrary to the documentation's intended specification that the voting should occur only once.
A simple proof-of-concept is as follows, add the test in MartenitsaVoting.t.sol and run forge test —mt testVotingPeriodCanBeExtendedMoreThanOneDay. The success indicate the voting period might exceed one day.

function testVotingPeriodCanBeExtendedMoreThanOneDay() public {
uint256 startTime = block.timestamp;
uint256 duration = 1 days;
​
// set the orignal time and start voting
vm.warp(startTime);
voting.startVoting();
assertEq(voting.startVoteTime(), startTime);
​
// The owner reset the start voting time
uint256 newStartTime = startTime + duration - 1 seconds;
vm.warp(newStartTime);
voting.startVoting();
assertEq(voting.startVoteTime(), newStartTime);
​
// the actual voting time will exceed 1 day
uint256 endTime = newStartTime + duration;
assertGt(endTime - startTime, 1 days);
​
// owner can start another voting which is not allowed
vm.warp(endTime + 1 days);
voting.startVoting();
}

Impact

The extended voting period is different from the protocol's original intention, potentially giving users additional time to vote, this might result in unintended voting outcomes.

Tools Used

Manual Review, Foundry Test

Recommendations

To prevent the voting period being reset, validate the MartenitsaVoting::startVoting before updating the state variable.

function startVoting() public onlyOwner {
+ require(startVoteTime==0, "Invalid Operation");
startVoteTime = block.timestamp;
emit Voting(startVoteTime, duration);
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.