President Elector

Summary

In RankedChoice::selectPresidentfunction, block.timestampis used to calculate if 1460 (~4 years) have passed after the last election.

Vulnerability Details

block.timestampcan be manipulated by the attacker (mostly miners and validators) and allow the attacker to execute the function prematurely or delay the execution of the function leading to unexpected behaviour.

Impact

In RankedChoicecontract, it is vital to allow anyone to execute RankedChoice::selectPresidentfunction only after the completion of 1460 days. The usage of block.timestamp in time calculation will allow attacker to elect presidents before the maturity of 1460 days and therefore break the contract.

Tools Used

1. Foundry

2. Slither

3. Remix

Recommendations

Instead of using block.timestamp, block.numbercan be used for duration calculation.