President Elector

Summary

function RankedChoice::rankCandidatebySig uses the solidity precompile function ecrecover , however the return value of 0 is not checked for.

Vulnerability Details

" The ecrcover recover the address associated with the public key from elliptic curve signature or return zero on error."

According to the solidity docs. see --- https://docs.soliditylang.org/en/v0.8.9/units-and-global-variables.html?highlight=ecrecover#mathematical-and-cryptographic-functions

Upon error you can supply invalid input parameters to the RankedChoice::rankCandidatebySig function then the check is matched and the signature checker is bypassed.

``

Enabling an attacker to DDOS the election and influence the result of the election.

Impact

An attacker can determine the Election Outcome and elect whoever they want

Tools Used

Manual Analysis

Recommendations

The check require(signer != address(0), "Invalid signature")should be added to the return value of the signature recovered using ecrecover before the external interaction _rankCandidates(orderedCandidates, signer)is done.