Summary

Voters can submit rankings that include the same candidate multiple times (e.g., [A, A, A]). The current implementation does not check for duplicate entries, which can lead to overcounting votes for that candidate and violate the principle of one person, one vote.

Vulnerability Details

• Affected Function: _selectPresidentRecursive

• Issue Explanation:

  • No Duplicate Checks: The contract does not verify whether a voter's orderedCandidates contains unique candidates.

  • Vote Overcounting: When tallying votes, the first preference of a voter is counted. However, if duplicates exist, and if the candidate is eliminated, the vote may incorrectly be transferred back to the same candidate.

  • Violates Voting Principles: This behavior can give unfair advantage to candidates with duplicate entries in voter rankings.

Impact

Severity: Medium

• Election Integrity: The fairness of the election is compromised due to improper vote counting.

• Unintended Outcomes: Candidates may receive more votes than warranted, skewing the election results.

Tools Used

• Manual Code Review: Identified lack of duplicate entry checks in voter rankings.

Recommendations

• Validate Voter Rankings:

  • Uniqueness Check: Ensure that each candidate appears only once in a voter's ranking.

    function _rankCandidates(

    address[] memory orderedCandidates,

    address voter

    ) internal {

    // Existing checks...

    require(_isUniqueArray(orderedCandidates), "Duplicate candidates in ranking");

    // Rest of the function...

    }
    function _isUniqueArray(address[] memory array) internal pure returns (bool) {

    for (uint256 i = 0; i < array.length - 1; i++) {

    for (uint256 j = i + 1; j < array.length; j++) {

    if (array[i] == array[j]) {

    return false;

    }

    }

    }

    return true;

    }

• Update Vote Counting Logic:

  • Modify the tallying mechanism to account for and ignore duplicate entries.

• Educate Voters:

  • Provide guidelines to voters on how to correctly submit their rankings without duplicates.