Submission Details
Severity:
Signature Replay Attack
Description
In the RankedChoice.sol::rankCandidatesBySig function, there is no nonce or deadline mechanism implemented. This makes the signature reusable across different voting rounds. A malicious actor could reuse a previously valid signature in a future presidential elections
Impact
A malicious actor could reuse the signature in future votes rounds to corrupt the integrity of the elections
Recommended mitigation
Implement a nonce system tied to the voting number or a deadline to ensure each signature is used only once per vote.
Updates
Lead Judging Commences
inallhonesty
12 months ago
inallhonesty 12 months ago
Submission Judgement Published Assigned finding tags:
Replay Attack - The same signature can be used over and over
Appeal created
ivanonchain
12 months ago
inallhonesty 12 months ago
Submission Judgement Published Assigned finding tags:
Replay Attack - The same signature can be used over and over
Rewards breakdown
nSLOC
140This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.