Submission Details
Severity:
Vote winner is expected to be rewarded with 1 HealthToken but is instead rewarded with 1000000000000000000 HealthToken
Summary
The issue here is that MartenitsaVoting::announceWinner which is used to reward the winner of the voting process does not consider the 10 ** 18 which was used in the calculation of the amountToMint in HealthToken::distributeHealthToken, and when a winner is announced the winner gets 1000000000000000000 HealthTokeninstead of 1`
POC (also using the Bast Test)
function testAnnounceWinner() public listMartenitsa {
vm.prank(bob);
voting.voteForMartenitsa(0);
vm.warp(block.timestamp + 1 days + 1);
vm.recordLogs();
voting.announceWinner();
Vm.Log[] memory entries = vm.getRecordedLogs();
address winner = address(uint160(uint256(entries[0].topics[2])));
assert(winner == chasy);
assertEq(healthToken.balanceOf(chasy), 1000000000000000000);
}
Recommendation
Consider the 10 ** 18 that was used in the calculation of amountToMint in HealthToken::distributeHealthToken in MartenitsaVoting::announceWinner or remove the 10 ** 18.
Rewards breakdown
nSLOC
239This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.