President Elector
First Flight #24
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Missing input validation for the orderedCandidates Array

solgoodman

Summary

The contract lacks input validation for the orderedCandidates array. Specifically, it does not check for duplicate addresses or the presence of the zero address. These missing validations can distort the ranking process and undermine the integrity of the voting system.

Vulnerability Details

The issue is present in the _rankCandidates function, which accepts an array of candidates without validating:

  1. Duplicate addresses.

  2. The zero address.

Impact

The missing validations can lead to several issues:

  1. Duplicate Candidates: Duplicate entries can distort the ranking process, affecting the accuracy of the election results.

  2. Zero Address: Including the zero address as a candidate can introduce errors or unintended behavior in the voting process.

Tools Used

  • Manual review

  • Remix IDE

Recommendations

To address these issues, implement additional validation checks in the _rankCandidates function:

  1. Ensure Unique Entries: Validate that the orderedCandidates array does not contain duplicate addresses.

  2. Disallow Zero Address: Ensure that the zero address is not included as a candidate.

function _rankCandidates(
address[] memory orderedCandidates,
address voter
) internal {
if (orderedCandidates.length > MAX_CANDIDATES) {
revert RankedChoice__InvalidInput();
}
if (!_isInArray(VOTERS, voter)) {
revert RankedChoice__InvalidVoter();
}
if (_isInArray(orderedCandidates, msg.sender)) {
revert RankedChoice__VoterInCandidates();
}
for (uint256 i = 0; i < orderedCandidates.length; i++) {
if (orderedCandidates[i] == address(0)) {
revert RankedChoice__ZeroAddress();
}
for (uint256 j = i + 1; j < orderedCandidates.length; j++) {
if (orderedCandidates[i] == orderedCandidates[j]) {
revert RankedChoice__DuplicateCandidate();
}
}
}
​
s_rankings[voter][s_voteNumber] = orderedCandidates;
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

rankCandidates() allows duplicate votes inside the `orderedCandidates` array

Appeal created

inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

rankCandidates() allows duplicate votes inside the `orderedCandidates` array

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.