President Elector

First Flight #24
Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: medium
Invalid

DOS if VOTERS is too big (Deny Of Service)

Summary

If VOTERS is too big, the execution of the selectPresident() function will fail.

Vulnerability Details

The selectPresident() function calls _selectPresidentRecursive() at line 79 of RankedChoice.sol.

If VOTERS (address[] private VOTERS) is too big, the gas consumed will exceed the block gas limit causing the execution of the _selectPresidentRecursive() function to fail.

Then, there will be no way to select the new president.
And there is no way to change the VOTERS list because it was loaded at the construction of the contract (in the constructor() function):

constructor(address[] memory voters) EIP712("RankedChoice", "1") {
VOTERS = voters;
i_presidentalDuration = 1460 days;
s_currentPresident = msg.sender;
s_voteNumber = 0;
}

nor change the 'vote number' => s_voteNumber, because it is incremented at the end of the _selectPresidentRecursive() function => RankedChoice.sol#L92.

// Reset the election and set President
s_currentPresident = winnerList[0];
s_candidateList = new address[](0);
s_previousVoteEndTimeStamp = block.timestamp;
s_voteNumber += 1;

Impact

There will be no way to select the new president, change the VOTERS list nor change the vote number to bypass the execution failure.
But in an election of a President, VOTERS will automatically be a huge array, then in production it will fail eventually.

Tools Used

Github, VisualCode.

Recommendations

You can not loop a really huge array because of the block gas limit (which is in place to avoid an infinite transaction loop attack on the blockchain).
The design choice needs to be rethought to avoid looping VOTERS.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[INVALID] A high number of voters can lead to OOG in selecting the president

Appeal created

0xziin Submitter
about 1 year ago
inallhonesty Lead Judge
about 1 year ago
0xziin Submitter
about 1 year ago
inallhonesty Lead Judge
about 1 year ago
0xziin Submitter
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

[INVALID] A high number of voters can lead to OOG in selecting the president

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.