President Elector
First Flight #24
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No initialization of s_previousVoteEndTimeStamp potentially leads to unfair selection of the president

0xwhyzee

Summary

Anyone can immediately select the president after the first voter submits their choice of candidates, resulting in unfair selection of the president.

Vulnerability Details

The vulnerability lies in L61-L64 of the contract.

The variable s_previousVoteEndTimeStamp is not set upon contract deployment, resulting in a default value of 0. This means that anyone can immediately select the president after the first voter submits their choice of candidates, if the value of current block.timestamp is greater than 126144000.

For reference, the epoch timestamp of Thu, 19 Sep 2024 00:00:00 GMT is 1726704000, which is easily greater than 126144000, making this vulnerability highly possible.

Proof Of Concept

Working test case

function testSelectPresidentAfterContractSetup() public {
// Simulate current block.timestamp to be a large number > 126144000 (1460 days)
vm.warp(block.timestamp + rankedChoice.getDuration());
​
// Voter votes for one candidate
orderedCandidates = [candidates[0]];
vm.prank(voters[0]);
rankedChoice.rankCandidates(orderedCandidates);
​
// Candidate selected as president before 4 years duration since contract deployment
rankedChoice.selectPresident();
assertEq(rankedChoice.getCurrentPresident(), candidates[0]);
}

Impact

Anyone can call the selectPresident function after the first voter submits their choice of candidates, resulting in unfair selection of the president.

Tools Used

Foundry, manual review

Recommended Mitigation

To mitigate this vulnerability, the variable s_previousVoteEndTimeStamp should be set to current block.timestamp during contract deployment.

constructor(address[] memory voters) EIP712("RankedChoice", "1") {
VOTERS = voters;
i_presidentalDuration = 1460 days;
s_currentPresident = msg.sender;
s_voteNumber = 0;
+ s_previousVoteEndTimeStamp = block.timestamp
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`s_previousVoteEndTimeStamp` variable not being initialized correctly

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.