President Elector

Summary

The _rankCandidates and rankCandidates functions do not implement any time-based restrictions, allowing voters to continue voting even after the deadline for the election has passed. This can lead to an unfair advantage for voters who can still submit or modify their votes beyond the intended voting period, as long as selectPresident() has not been called to close the voting process.

Vulnerability Details

The contract's design includes a specific time frame for voting (approximately 4 years or 1460 days) after which a new president is elected. The vulnerability lies in the fact that there are no time checks in place within the _rankCandidates and rankCandidates functions to prevent voters from submitting or modifying their votes beyond the voting period.

If voters are allowed to vote or change their rankings after the voting deadline, it could lead to manipulation or unintended behavior in the election process.

• _rankCandidates Function: This internal function is responsible for updating the rankings of a given voter for the current vote. It does not include any check to ensure that the voter is submitting their ranking within the voting period.

• rankCandidates Function: This external function allows voters to submit their ranking of candidates, but it similarly lacks any restriction based on the current timestamp.

Without a time check, malicious voters can exploit this vulnerability to:

• Wait until most voters have cast their votes and then submit or change their own ranking to influence the final result.

• Delay calling selectPresident() and keep voting or modifying their choices, especially if they want to favor a particular candidate.

Impact

Allowing voters to cast or modify votes beyond the intended voting period can lead to manipulation of the election outcome. The integrity of the voting process is compromised, as voters can submit late votes or wait until the majority of votes are cast before submitting their ranking, thus unfairly influencing the final result.

Tools Used

Manual Review

Recommendations

Implement a time check in both _rankCandidates and rankCandidates functions to ensure that voting can only occur within the allowed period (e.g., within the first 4 years of the election).

After the voting period ends, voters should be prohibited from submitting or modifying their rankings.