President Elector

First Flight #24
Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: medium
Valid

Signature Replay Attack

Description
In the RankedChoice.sol::rankCandidatesBySig function, there is no nonce or deadline mechanism implemented. This makes the signature reusable across different voting rounds. A malicious actor could reuse a previously valid signature in a future presidential elections

Impact
A malicious actor could reuse the signature in future votes rounds to corrupt the integrity of the elections

Recommended mitigation
Implement a nonce system tied to the voting number or a deadline to ensure each signature is used only once per vote.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Replay Attack - The same signature can be used over and over

Appeal created

ivanonchain Submitter
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Replay Attack - The same signature can be used over and over

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.