Core Contracts

Summary

The recordVote function in the veRAACToken contract lacks proper access control, allowing any external caller to record a vote on behalf of any voter. This enables attackers to mark legitimate voters as having already voted, preventing them from participating in governance decisions. Additionally, the function does not validate whether the proposalId corresponds to an active or valid proposal, which may lead to votes being recorded for non-existent or expired proposals.

Vulnerability Details

The function recordVote is defined as external, meaning any address can call it. However, it allows an arbitrary voter address to be passed in, without ensuring that msg.sender is actually the voter. This means an attacker can execute:

This would mark victimAddress as having voted (_hasVotedOnProposal[voter][proposalId] = true;), effectively blocking them from voting.

Furthermore, the function does not check whether proposalId is valid, which could allow votes to be recorded for non-existent or expired proposals.

Code Snippet

Impact

• Any user can mark others as having already voted, preventing them from casting their actual votes.

• The function does not validate whether the proposalId is valid or still active.

Tools Used

Manual review.

Recommendations

1. Restrict the function to the actual voter by requiring msg.sender == voter:

   require(msg.sender == voter, "Unauthorized voter");

2. Validate that proposalId is active before recording the vote: