President Elector

Summary

A voter is still able to vote after a call to selectPresident() starts the selection process.

Vulnerability Details

As there are no checks in place restricting a voter from voting after the selection process has started, a voter can call rankCandidates() after the call to selectPresident(). The voter can then frontrun the transaction and change their vote before the selection process begins.

Impact

This could allow a voter to change their vote at the last minute which could potentially affect the outcome of the election.

Tools Used

Manual Review

Recommendations

Add a check that prevents a voter from calling rankCandidates() after the selection process has started. This could be done by using an enum to keep track of the different stages of the election process and once the selection stage has started no further voting will be allowed.