Submission Details
Severity:
MAX_CANDIDATES limit can be bypassed due to incorrect logic of computing candidates list
Summary
Generating the candidates list from s_rankings user inputs result in breaking the MAX_CANDIDATES limit.
Vulnerability Details
The candidates list s_candidateList is computed from the user input s_rankings. Each user giving diffrent address for candidates ranking leads to bypassing MAX_CANDIDATES = 10 limit
Impact
Bypass max number of candidates. Larger number of candidates leads to disparency in election.
Tools Used
Manula review
Recommendations
implement a function to register candidates and validate user input in rankCandidates(address[]) to ensure no invalid candidates address. Helps to reduce gas also
Rewards breakdown
nSLOC
140This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.