Submission Details
Severity:
The token with id=0 will aways win the voting when there are no participants
Summary
The token with id=0 will win the voting process always when there are no participants in the vote.
Vulnerability Details
As the default value of uint256 is 0, if there aren't participants in the voting, and the token with id=0 is listed for sale, it win.
POC
function testMTZeroWillWinIfNoParticipants() public startVoting listMartenitsa {
uint256 chasyHTbeforeWinning = healthToken.balanceOf(chasy);
console.log("Balance of Chasy before the voting: ", chasyHTbeforeWinning);
vm.warp(block.timestamp + 1 days + 1);
voting.announceWinner();
uint256 chasyHTAfter = healthToken.balanceOf(chasy);
console.log("Balance of Chasy after the voting: ", chasyHTAfter);
assert(chasyHTbeforeWinning < chasyHTAfter);
}
Impact
The first minted MT can be listed for a very high price and win some HT when nobody votes.
Tools Used
Manual Review
Recommendations
Revert if the winner has 0 votes.
Updates
Lead Judging Commences
bube over 1 year ago
Submission Judgement Published Assigned finding tags:
`tokenId=0` wins the voting
Rewards breakdown
nSLOC
239This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.