Summary

Voters can change their vote by calling `RankedChoice::rankCandidates` as many times as they want before president election.

Vulnerability Details

There is no check that takes into account if someone has already voted in a particular `voteNumber`.

Impact

Voters can change their vote (before the president election)

POC

```

address[] orderedCandidates2;

function test_ReVote() public {

orderedCandidates = [candidates[1], candidates[0], candidates[2]];

orderedCandidates2 = [candidates[2], candidates[0], candidates[1]];

vm.startPrank(voters[0]);

rankedChoice.rankCandidates(orderedCandidates);

rankedChoice.rankCandidates(orderedCandidates2);

vm.stopPrank();

:brassertEq(rankedChoice.getUserCurrentVote(voters[0]), orderedCandidates2);

}

```

```

Ran 1 test for test/RankedChoiceTest.t.sol:RankedChoiceTest

[PASS] test_ReVote() (gas: 542078)

Traces:

[542078] RankedChoiceTest::test_ReVote()

├─ [0] VM::startPrank(0x0000000000000000000000000000000000000064)

│ └─ ← [Return]

├─ [312448] RankedChoice::rankCandidates([0x00000000000000000000000000000000000000C9, 0x00000000000000000000000000000000000000C8, 0x00000000000000000000000000000000000000ca])

│ └─ ← [Stop]

├─ [20848] RankedChoice::rankCandidates([0x00000000000000000000000000000000000000ca, 0x00000000000000000000000000000000000000C8, 0x00000000000000000000000000000000000000C9])

│ └─ ← [Stop]

├─ [0] VM::stopPrank()

│ └─ ← [Return]

├─ [1918] RankedChoice::getUserCurrentVote(0x0000000000000000000000000000000000000064) [staticcall]

│ └─ ← [Return] [0x00000000000000000000000000000000000000ca, 0x00000000000000000000000000000000000000C8, 0x00000000000000000000000000000000000000C9]

├─ [0] VM::assertEq([0x00000000000000000000000000000000000000ca, 0x00000000000000000000000000000000000000C8, 0x00000000000000000000000000000000000000C9], [0x00000000000000000000000000000000000000ca, 0x00000000000000000000000000000000000000C8, 0x00000000000000000000000000000000000000C9]) [staticcall]

│ └─ ← [Return]

└─ ← [Stop]

Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.09ms (494.34µs CPU time)

```

Tools Used

Manual review

Recommendations

Add proper check in the ‘RankedChoice::rankCandidates` to guarantee that each voter can vote only once