Submission Details
Severity:
Unfair winner decision if several tokens has the same votes
Summary
Unfair winner decision if several tokens has the same votes
Vulnerability Details
In MartenitsaVoting::announceWinner(), contract will loop the whole _tokenIds to check the maxVotes. However, if several tokens share the maxVotes, rewards will be distributed to one of them. This is unfair.
function announceWinner() external onlyOwner {
require(block.timestamp >= startVoteTime + duration, "The voting is active");
uint256 winnerTokenId;
uint256 maxVotes = 0;
for (uint256 i = 0; i < _tokenIds.length; i++) {
if (voteCounts[_tokenIds[i]] > maxVotes) {
maxVotes = voteCounts[_tokenIds[i]];
winnerTokenId = _tokenIds[i];
}
}
list = _martenitsaMarketplace.getListing(winnerTokenId);
_healthToken.distributeHealthToken(list.seller, 1);
emit WinnerAnnounced(winnerTokenId, list.seller);
}
Impact
Some tokens with maxVotes cannot receive the rewards.
Tools Used
Manual
Recommendations
Updates
Lead Judging Commences
bube about 1 year ago
Submission Judgement Published Assigned finding tags:
Tie in voting is not considered
Rewards breakdown
nSLOC
239This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.