President Elector

Summary

rankCandidatesBySig() does not pass the rankings provided by the signer. Instead, it allows the caller of rankCandidatesBySig() to rank candidates however they want using the signature of an approved voter.:brThis allows users who are not eligible to vote, to vote in the election.

Vulnerability Details

Impact

Allows ineligible users vote in the election. Can also replay the signature providing different rankings each time to then game the election outcome. A contract could be created that reads the votes and then votes accordingly to generate a specific outcome.

Tools Used

Manual Review

Recommendations

Implement a "isExecuted" mapping in RankedChoice.sol that keeps track of the signatures already executed. Then, implement a check in rankCandidatesBySig() before the call to _rankCandidates that ensures the signature has not already been executed. This prevents signed un-sent transactions from being replayed in rankCandidatesBySig().