President Elector

Summary

The RankedChoice contract includes a function to submit ranked candidate choices via a signature rankCandidatesBySig, utilizing the EIP-712 standard. While this is a standard and secure method of enabling off-chain voting with on-chain verification, the current implementation lacks nonce management or safeguards against replay attacks. This could allow an attacker to reuse a valid signature to submit the same vote multiple times, skewing election results or manipulating the voting process.

Vulnerability Details

The rankCandidatesBySig function allows voters to sign a message off-chain and submit it to the contract for verification

However, the contract does not manage nonces or unique identifiers to ensure that each signature can only be used once. This leaves the contract vulnerable to replay attacks, where an attacker could:

A malicious actor could capture a valid signature and submit it repeatedly to the contract, casting the same vote multiple times.
Without adequate protections, the same signature could potentially be reused across different deployments of the contract on other networks or forks of the blockchain.
A malicious actor could wait and resubmit the same valid signature in future elections if nonce or timestamp checks are not in place, affecting subsequent election rounds.

Impact

A replay attack would allow a single vote to be counted multiple times, skewing the election results in favor of the candidate associated with the repeated votes.

Tools Used

Manual Review

Recommendations

Introduce a nonce mechanism to track each voter's signature submissions. Each voter should have a unique nonce that increments after each valid vote, ensuring that the same signature cannot be replayed.

Add a timestamp or election round ID to the signature message hash. This ensures that signatures from previous elections or expired timeframes cannot be reused in future rounds.

Implement a time-bound validation for signatures, where a signature is only valid for a specific voting period. This prevents the use of old signatures in new voting periods.