First Flight #13: Baba Marta

Summary

Unfair winning of producer in case of equal votes in announceWinner function.

Vulnerability Details

When the voting event is concluded and vote count is calculated using announceWinner function. The tokenId with highest number of votes is the winner.

But in the case where there are more than 1 tokenIds with same amount of votes, only the first producer whose tokenId is present the earliest in the _tokenId array, will be the winner and other producers will not receive the HealthToken.

Impact

Only the producer present first in the _tokenId array will be decided and declared as a winner in the case of equal votes. This is unfair for other producers who got the equal votes. According to the intended design by the protocol, each producer of equal votes should be the winner.

Tools Used

Manual Review

Recommendations

Each producer in case of equal votes should be a winner and should be provided with a HealthToken.