President Elector

Summary

The RankedChoice contract does not emit events for critical actions such as ranking candidates or selecting a new president. The absence of event logs hampers transparency, monitoring, and debugging efforts, making it difficult to track the contract's state and history.

Vulnerability Details

• Missing Events:

  • Ranking Candidates:

    • Functions rankCandidates and rankCandidatesBySig do not emit events upon successful ranking.

  • Selecting President:

    • The selectPresident function does not emit an event when a new president is selected.

Impact

• Users cannot easily verify their votes or monitor election progress.

• Reduced trust in the contract's operations as actions are not transparently recorded.

Tools Used

• Manual Code Review: Identified the absence of event declarations and emissions within critical functions.

• Static Analysis Tools: Verified the lack of event-related patterns using tools like Slither.

Recommendations

• Ranking Candidates:

  event CandidatesRanked(address indexed voter, address[] orderedCandidates);

  function rankCandidates(address[] memory orderedCandidates) external {

  ...

  emit CandidatesRanked(msg.sender, orderedCandidates);

  }

  function rankCandidatesBySig(

  address[] memory orderedCandidates,

  bytes memory signature

  ) external {

  ...

  emit CandidatesRanked(signer, orderedCandidates);

  }

• Selecting President:

  event PresidentSelected(address indexed newPresident, uint256 voteNumber);

  function selectPresident() external {

  ...

  emit PresidentSelected(s_currentPresident, s_voteNumber);

  }

• Emit Events in Internal Functions:

  • Ensure that helper functions like _rankCandidates also emit relevant events to capture every state change.

• Leverage Indexed Parameters:

  • Use indexed keyword for frequently queried parameters to enhance event filtering and retrieval efficiency.

    event CandidatesRanked(address indexed voter, address[] orderedCandidates);

    event PresidentSelected(address indexed newPresident, uint256 voteNumber);

POC

• Implement tests to verify that events are correctly emitted during critical actions.

  function testEventEmissions() public {

  address[] memory orderedCandidates = new address[]();

  orderedCandidates[0] = address(1);

  orderedCandidates[1] = address(2);

  orderedCandidates[2] = address(3);

  vm.expectEmit(true, false, false, true);

  emit CandidatesRanked(voters[0], orderedCandidates);

  rankedChoice.rankCandidates(orderedCandidates);

  vm.warp(block.timestamp + rankedChoice.getDuration());

  vm.expectEmit(true, false, false, true);

  emit PresidentSelected(address(1), 0);

  rankedChoice.selectPresident();

  }