President Elector

Summary

The rankCandidates() function in the RankedChoice contract does not properly validate that the orderedCandidates array contains unique candidates. A user can potentially rank the same candidate multiple times, which may lead to unintended voting behavior.

Vulnerability Details

The vulnerability arises because there is no check in place to ensure that each candidate is ranked only once in the orderedCandidates array. Without this validation:

1. A voter can submit an array where the same candidate is ranked multiple times (e.g., [candidate1, candidate1, candidate2]), which may not be the intended use of ranked voting.

2. The contract allows up to 10 candidates, but there is no check to ensure that candidates are unique within the same list, leading to potential vote distortion or manipulation.

Impact

Vote Distortion: Voters could intentionally or unintentionally give one candidate multiple votes by ranking them in multiple positions, leading to inaccurate vote counting.

• Election Manipulation: Malicious users could exploit this loophole by submitting votes that heavily favor one candidate, undermining the fairness of the election.

• Unintended Behavior: The lack of validation could result in voters mistakenly submitting incorrect ballots, leading to confusion and potential miscounts.

Tools Used

Recommendations

Check for Duplicate Candidates: Introduce validation to ensure that the orderedCandidates array does not contain duplicate candidates. The contract should revert if any candidate appears more than once in the ranked list.

Example Solution:

Ensure Unique Candidates: This validation ensures that each candidate is ranked only once, preventing potential vote distortion and manipulation.