First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

The MartenitsaVoting::startVoting is not effective as users can vote when this has not been called.

0x0noob

Summary

People generally are expected to only be able to vote after the MartenitsaVoting::startVoting has been called by the owner. However, this is not the case as users can vote upon deployment of the contract. The issue here is that MartenitsaVoting::voteForMartenitsa does not have any implementation which checks for whether the vote has started but checks if they have ended.

POC

contract POC is Test {
MartenitsaMarketplace martenitsaMarketplace;
HealthToken health;
MartenitsaToken martenitsaToken;
MartenitsaVoting voting;
​
address buyer = makeAddr("buyer");
​
address[] public producers;
address chasy = makeAddr("chasy");
​
function setUp() public {
producers.push(chasy);
martenitsaToken = new MartenitsaToken();
health = new HealthToken();
martenitsaMarketplace = new MartenitsaMarketplace(address(health), address(martenitsaToken));
voting = new MartenitsaVoting(address(martenitsaMarketplace), address(health));
​
health.setMarketAndVotingAddress(address(martenitsaMarketplace), address(voting));
martenitsaToken.setProducers(producers);
​
vm.deal(buyer, 2 ether);
}
​
function test__voteStartsAnyTime() public {
vm.startPrank(chasy);
martenitsaToken.createMartenitsa("bracelet");
martenitsaMarketplace.listMartenitsaForSale(0, 1 wei);
martenitsaToken.approve(address(martenitsaMarketplace), 0);
vm.stopPrank();
​
vm.startPrank(buyer);
voting.voteForMartenitsa(0);
assert(voting.hasVoted(buyer) == true);
assert(voting.voteCounts(0) == 1);
vm.stopPrank();
​
}

Impact

From the POC above, it can be deduced that upon deployment, any user can cast their vote. This however does not result in any movement of funds but the protocol does not work as intented.

Recommendation

Add extra checks in MartenitsaVoting::voteForMartenitsa to ensure that voting can only start when initiated.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
0x0noob Submitter
over 1 year ago
bube Lead Judge
over 1 year ago
0x0noob Submitter
over 1 year ago
bube Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.