Summary

There will be lots of repeated tokenId in array _tokenIds, which could lead to announceWinner() failure because of out of gas.

Vulnerability Details

In MartenitsaVoting::voteForMartenitsa(), voters will vote for tokens. Variable _tokenIds will record all voted tokens. However, if one token has already existed in _tokenIds, one same tokenId will be added in _tokenIds when someone vote for this token. This will lead to the array pretty larger than expected. This could lead to possible Dos in announceWinner().

Impact

_tokenIds's length is pretty larger than expected, and may lead to announceWinner() because of out of gas.

Tools Used

Manual

Recommendations

If some token id has already exist in _tokenIds, skip adding to the array.