President Elector
First Flight #24
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The first president can be changed at any time

pob001

Relevant GitHub Links

https://github.com/Cyfrin/2024-09-president-elector/blob/main/src/RankedChoice.sol#L61-L66

Summary

In the RankedChoice::selectPresident function, there is a condition that checks if 4 years have passed since the president was elected: block.timestamp - s_previousVoteEndTimeStamp <= i_presidentalDuration. For the first president, s_previousVoteEndTimeStamp is set to 0, and since block.timestamp > i_presidentalDuration, the selectPresident function won't revert, even though 4 years haven't passed yet, allowing a new president to be selected.

Impact

Someone can replace the first president before their 4-year term ends.

Furthermore, if a voter immediately after contract creation (before other voters submit their votes) calls RankedChoice::rankCandidates and then RankedChoice::selectPresident, they could select the president they prefer.

Recommendations

In the constructor, update s_previousVoteEndTimeStamp to block.timestamp:

constructor(address[] memory voters) EIP712("RankedChoice", "1") {
VOTERS = voters;
i_presidentalDuration = 1460 days;
s_currentPresident = msg.sender;
s_voteNumber = 0;
+ s_previousVoteEndTimeStamp = block.timestamp;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`s_previousVoteEndTimeStamp` variable not being initialized correctly

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.