Summary

A voter can access the entire s_rankings mapping at any time before the next election and manipulate the elections in their favour.

Vulnerability Details

Private variables are not secure, and since the VOTERS and the s_rankings arrays are storage variables, any voter could check the storage of that contract and try and manipulate the contract.

Imagine the contract is deployed and visible on Etherscan. Bob is one of the voters and the only voter left to rank candidates. Bob decides to take a look at the storage of the contract at the time of deployment, and sees that there is a tie between 2 candidates, A and B. Bob now knows that his vote will decide the next President.

Impact

Manipulation of the elections for the next President.

Tools Used

Manual Review

Recommendations

Encrypt the rankings of the candidates (s_rankings).