President Elector
First Flight #24
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Record-Keeping for Tallied Ranks

brene

Summary

The RankedChoice contract implements a ranked choice voting system but lacks a dedicated record to keep track of tallied ranks. This oversight could potentially lead to issues in verifying the accuracy and completeness of vote counting.

Vulnerability Details

The contract stores vote counts in a mapping (s_candidateVotesByRound) but lacks a corresponding record for tallied ranks.

mapping(address candidate => mapping(uint256 voteNumber => mapping(uint256 roundId => uint256 votes)))
private s_candidateVotesByRound;

Rankings submitted by voters are stored in another mapping (s_rankings).

mapping(address voter => mapping(uint256 voteNumber => address[] orderedCandidates))
private s_rankings;

The contract iterates through rankings to count votes, but doesn't maintain a comprehensive log of counted ranks.

for (uint256 i = 0; i < VOTERS.length; i++) {
for (
uint256 j = 0;
j < s_rankings[VOTERS[i]][s_voteNumber].length;
j++
) {
address candidate = s_rankings[VOTERS[i]][s_voteNumber][j];
if (_isInArray(candidateList, candidate)) {
s_candidateVotesByRound[candidate][s_voteNumber][roundNumber] += 1;
break;
}
}
}

Impact

Without a dedicated record, it's challenging to verify that all votes have been accurately counted.
There's no clear way to detect if a rank has been counted twice within a round.
It's difficult to reconstruct the voting history or verify the integrity of the tallying process.
Identifying issues during elections becomes more complex due to the lack of comprehensive logging.

Tools Used

Manual Review

Recommendations

To address this issue, the following actions are recommended:
Implement events to log vote counting progress, including candidate names, voter addresses, and round numbers.
Create a separate mapping to keep track of tallied ranks, indexed by candidate address, vote number, and round ID.
Add unique identifiers for each vote/rank combination to allow for easy tracking and verification.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.