Summary

Vulnerability Details

function rankCandidatesBySig(
address[] memory orderedCandidates,
bytes memory signature
) external {
bytes32 structHash = keccak256(abi.encode(TYPEHASH, orderedCandidates));
bytes32 hash = _hashTypedDataV4(structHash);
address signer = ECDSA.recover(hash, signature);
_rankCandidates(orderedCandidates, signer);
}

Impact

a malicious user code reuse the same signature in rankCandidatesBySig to get ranked

Tools Used

manual review

Recommendations

a nonce should be added to the signature to avoid reuse of signature