President Elector

Summary

The RankedChoice contract does not enforce any time restriction on when voters can submit their candidate rankings. This omission allows users to vote at any time, including long after the election period has ended, which could lead to invalid or manipulated election outcomes.

Vulnerability Details

The vulnerability arises from the absence of a clear voting window mechanism. Voters can submit their votes through the rankCandidates and rankCandidatesBySig functions at any time, even after the election has ended. Without restricting the voting period:

1. Voters may cast their vote outside the intended voting window.

2. Malicious actors could influence the election by submitting votes after seeing preliminary results, manipulating the outcome.

3. There is no mechanism to ensure that votes are only submitted during the active voting period.

Impact

Invalid Votes: Voters may unintentionally or maliciously submit votes after the election should have ended, leading to inaccurate results.

• Manipulation Risk: Attackers could exploit the lack of time restriction to manipulate the voting process by submitting votes outside of the official voting window, especially after assessing preliminary results.

• System Trust: Without a clear voting window, the legitimacy of election results could be questioned, undermining the system's integrity.

Tools Used

Recommendations

Set Voting Duration: Ensure that the start and end timestamps are configured when initiating the election, providing a clear voting window.

Enforce Voting Period: Introduce a voting window by adding a start and end timestamp to the voting period. Ensure votes are only accepted within this period.

• Example Solution:

  uint256 private s_votingStartTime;

  uint256 private s_votingEndTime;

  ​

  modifier onlyDuringVoting() {

  require(block.timestamp >= s_votingStartTime && block.timestamp <= s_votingEndTime, "Voting is not allowed at this time.");

  _;

  }

  ​

  function rankCandidates(address[] memory orderedCandidates) external onlyDuringVoting {

  _rankCandidates(orderedCandidates, msg.sender);

  }

  ​

  function rankCandidatesBySig(address[] memory orderedCandidates, bytes memory signature) external onlyDuringVoting {

  bytes32 structHash = keccak256(abi.encode(TYPEHASH, orderedCandidates));

  bytes32 hash = _hashTypedDataV4(structHash);

  address signer = ECDSA.recover(hash, signature);

  _rankCandidates(orderedCandidates, signer);

  }