Submission Details
Severity:
L-1. Lack of zero address check after ECDSA.recover causing ,when signature is invalid, ability to vote for zero address
Summary
Vulnerability Details
The ecrecover function returns zero address when the signature is invalid.
Impact
Anyone can vote for zero address by calling RankedChoice.sol::rankCandidatesBySig
Tools Used
Recommendations
Add zero address check to the RankedChoice.sol::rankCandidatesBySig function.
function rankCandidatesBySig(address[] memory orderedCandidates, bytes memory signature) external {
bytes32 structHash = keccak256(abi.encode(TYPEHASH, orderedCandidates));
bytes32 hash = _hashTypedDataV4(structHash);
address signer = ECDSA.recover(hash, signature);
+ if(signer == address(0)){
+ revert RankedChoice__InvalidVoter();
+ }
_rankCandidates(orderedCandidates, signer);
}
Rewards breakdown
nSLOC
140This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.