President Elector
First Flight #24
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Possible overwriting of previous votes

appet

Summary

In the s_rankings[voter][s_voteNumber] = orderedCandidates; logic, the contract allows a user to call the rankCandidates or rankCandidatesBySig functions multiple times within the same election (same s_voteNumber), thus the voter can overwrite their previous vote.

Impact

Overwriting the vote could lead to users initially vote honestly and then change their vote once they gain more information about how others are voting or continuously vote and modify their vote based on the progression of the election, gaining an unfair advantage. Combined with the possibility for passing same candidate address multiple times in their ranked list, part of another vulnerability would give disproportionate weight to their chosen candidate.

POC

Paste the following in the existing test suite:

function testSelectPresidentByOverwriting() public {
orderedCandidates = [candidates[0], candidates[1], candidates[2]];
vm.startPrank(voters[0]);
rankedChoice.rankCandidates(orderedCandidates);
vm.stopPrank();
​
orderedCandidates = [candidates[1], candidates[2], candidates[5]];
vm.startPrank(voters[1]);
rankedChoice.rankCandidates(orderedCandidates);
vm.stopPrank();
​
orderedCandidates = [candidates[0], candidates[1], candidates[2]];
vm.startPrank(voters[2]);
rankedChoice.rankCandidates(orderedCandidates);
vm.stopPrank();
orderedCandidates = [candidates[1], candidates[2], candidates[5]];
vm.startPrank(voters[0]);
rankedChoice.rankCandidates(orderedCandidates);
vm.stopPrank();
vm.warp(block.timestamp + rankedChoice.getDuration());
rankedChoice.selectPresident();
assertEq(rankedChoice.getCurrentPresident(), candidates[1]);
}

Tools Used

Manual review, Foundry

Recommendations

Enforce a strict one-vote-per-voter policy by adding a check before allowing any rankings to be recorded. For off-chain signatures (rankCandidatesBySig), ensure the vote includes a nonce tied to the current election. This prevents the signature from being reused across different elections.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Voters can change their vote

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.