Submission Details
Severity:
constructor() Allows No Voters to be Passed
Summary
The constructor allows no voters to be passed on deployment. This means that no one could use the rankCandidates() function given the subsequent check of msg.sender against address[] private Voters.
Vulnerability Details
constructor(address[] memory voters) EIP712("RankedChoice", "1") {
//@audit -- implement a REQUIRE here to ensure voters.length is > 0
VOTERS = voters;
i_presidentalDuration = 1460 days;
s_currentPresident = msg.sender;
s_voteNumber = 0;
}
Impact
Prevents any approved voters from using randCandidates() and voting directly on the first election.
Tools Used
Manual Review
Recommendations
Implement below:
constructor(address[] memory voters) EIP712("RankedChoice", "1") {
require(voters.length > 0, "voters can't be empty..");
VOTERS = voters;
i_presidentalDuration = 1460 days;
s_currentPresident = msg.sender;
s_voteNumber = 0;
}
Rewards breakdown
nSLOC
140This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.