Submission Details
Severity:
No Check for address(0) in Ordered Candidates
Summary
A voter is able to submit ordered candidates containing address(0).
Vulnerability Details
If a majority of the voters collude they can submit an orderedCandidates with address(0) as their preferred candidate.
Impact
This will result in the selection of address(0) as the next president which will remain in effect for the entire four year period until the next election.
Tools Used
Forge test
Recommendations
Add the following check to _rankCandidates():
if(_isInArray(orderedCandidates, address(0))) {
revert RankedChoice_InvalidInput();
}
Rewards breakdown
nSLOC
140This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.