Submission Details
Severity:
Wrong parameter in constant `TYPEHASH`
Summary
Description: There is a wrong parameter in constant TYPEHASH, it must be an array of address type but not uint256 type.
- bytes32 public constant TYPEHASH = keccak256("rankCandidates(uint256[])");
Vulnerability Details
We use TYPEHASH in rankCandidatesBySig function to get structHash, but as it is wrong , users will not be able to cast votes of other users using rankCandidatesBySig function.
function rankCandidatesBySig(
address[] memory orderedCandidates,
bytes memory signature
) external {
- bytes32 structHash = keccak256(abi.encode(TYPEHASH, orderedCandidates));
bytes32 hash = _hashTypedDataV4(structHash);
address signer = ECDSA.recover(hash, signature);
_rankCandidates(orderedCandidates, signer);
}
Recommendations
Change value type to address
+ bytes32 public constant TYPEHASH = keccak256("rankCandidates(address[])");
Updates
Lead Judging Commences
inallhonesty 11 months ago
Submission Judgement Published Assigned finding tags:
Typehash hashes the wrong function input.
Rewards breakdown
nSLOC
140This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.