Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of access control in recordVote() allows unauthorized Voting

nourelden

Summary

The recordVote() function in veRAACToken lacks proper access control, allowing any user to record votes on behalf of any other address. This completely compromises the voting system's integrity by enabling vote impersonation.

recordVote()

Vulnerability Details

The recordVote() function accepts an arbitrary voter address parameter without verifying that the caller (msg.sender) is authorized to vote for that address:

function recordVote(address voter, uint256 proposalId) external {
if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
_hasVotedOnProposal[voter][proposalId] = true;
​
uint256 power = getVotingPower(voter);
emit VoteCast(voter, proposalId, power);
}
​

A malicious actor can call this function with any address as the voter parameter, effectively casting votes on behalf of other users without their permission.

Impact

  • Vote Hijacking: Attackers can cast unauthorized votes using other users' voting power

  • Denial of Service: Once a vote is recorded for an address, the legitimate owner cannot vote

  • Governance Manipulation: Malicious actors can control proposal outcomes by impersonating large token holders

Recommendations

Modify the function to use msg.sender as the voter, removing the ability to specify an arbitrary address:

function recordVote(uint256 proposalId) external {
address voter = msg.sender;
if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
_hasVotedOnProposal[voter][proposalId] = true;
​
uint256 power = getVotingPower(voter);
emit VoteCast(voter, proposalId, power);
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::recordVote lacks access control, allowing anyone to emit fake events

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!