Submission Details
Severity:
Voting result can be manipulated via Sybil attack
Summary
Anyone has the right to vote. Hackers can make use of sybil attack to manipulate the voting result.
Vulnerability Details
In smart contract MartenitsaVoting, anyone own the right to vote. So hackers can make use of sybil attack to manipulate the vote result.
function voteForMartenitsa(uint256 tokenId) external {
require(!hasVoted[msg.sender], "You have already voted");
require(block.timestamp < startVoteTime + duration, "The voting is no longer active");
list = _martenitsaMarketplace.getListing(tokenId);
require(list.forSale, "You are unable to vote for this martenitsa");
hasVoted[msg.sender] = true;
voteCounts[tokenId] += 1;
_tokenIds.push(tokenId);
}
Impact
Voting result is easily manipulated.
Tools Used
Manual
Recommendations
Suggest adding some enter criteria, for example, only health token holders have the right to vote.
Updates
Lead Judging Commences
bube about 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Multiple addresses
Rewards breakdown
nSLOC
239This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.