Submission Details
Severity:
Producers can vote for their own Martenitsa
Summary
Producers can vote for their own Martenitsa which is not allowed by the protocol.
Vulnerability Details
There is no check for the user that wants to vote for a token.
function voteForMartenitsa(uint256 tokenId) external {
// @audit - There is no check if the msg.sender is a producer
require(!hasVoted[msg.sender], "You have already voted");
require(block.timestamp < startVoteTime + duration, "The voting is no longer active");
list = _martenitsaMarketplace.getListing(tokenId);
require(list.forSale, "You are unable to vote for this martenitsa");
hasVoted[msg.sender] = true;
voteCounts[tokenId] += 1;
_tokenIds.push(tokenId);
}
Impact
Producers can vote for their own Martenitsa
Tools Used
Manual review
Recommendations
Use the following check - require(!martenitsaToken.isProducer(msg.sender), "You cannot vote for your own martenitsa!");
Updates
Lead Judging Commences
bube about 1 year ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
Producers vote for themself
Rewards breakdown
nSLOC
239This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.