President Elector
First Flight #24
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

in the `RankedChoice` contract where users can vote multiple times with the same address.

yourguyd3v

Summary

The _rankCandidates function does not validate whether the voter has already cast their vote, allowing voters to overwrite their previous votes and potentially manipulate the outcome of the election.

Vulnerability Details

function _rankCandidates(address[] memory orderedCandidates, address voter) internal {
// Checks
if (orderedCandidates.length > MAX_CANDIDATES) {
revert RankedChoice__InvalidInput();
}
if (!_isInArray(VOTERS, voter)) {
revert RankedChoice__InvalidVoter();
}
​
@> // No check to prevent duplicate voting
s_rankings[voter][s_voteNumber] = orderedCandidates;
}
​

The vulnerability lies in the lack of a validation check to prevent voters from submitting multiple votes in the same voting round. The current implementation overwrites the voter's previous vote every time the rankCandidates or rankCandidatesBySig function is called. This allows any voter to change their vote as many times as they want, potentially skewing the election results.

Test:

function testUserCanVoteMultipulTimeWithSameAddress() public {
orderedCandidates = [candidates[0], candidates[1], candidates[2]];
vm.prank(voters[0]);
rankedChoice.rankCandidates(orderedCandidates);
​
assertEq(rankedChoice.getUserCurrentVote(voters[0]), orderedCandidates);
​
orderedCandidates2 = [candidates[1], candidates[0], candidates[2]];
vm.prank(voters[0]);
rankedChoice.rankCandidates(orderedCandidates2);
​
assertEq(rankedChoice.getUserCurrentVote(voters[0]), orderedCandidates2);
}

Test result:

[PASS] testUserCanVoteMultipulTimeWithSameAddress() (gas: 548175)
​

Impact

  • Election Manipulation: Voters can strategically alter their votes after observing other votes, gaining an unfair advantage in influencing the outcome.

  • Inconsistent Election Results: Voters may change their votes close to the end of the voting period, leading to confusion and inconsistent election results.

Tools Used

Manual Review
Foundry (for testing)

Recommendations

Implement a check in the _rankCandidates function to ensure that voters can only vote once per voting round.

+ if (s_rankings[voter][s_voteNumber].length > 0) {
+ revert RankedChoice__AlreadyVoted();
+}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Voters can change their vote

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.