Submission Details
Severity:
Attacker can vote for user even if user has no intention of voting
Summary
User can vote on behalf of someone, voting even when the user has no intention of voting.
Vulnerability Details
The recordVote allow users to vote
function recordVote(
address voter,
uint256 proposalId
) external {
if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
_hasVotedOnProposal[voter][proposalId] = true;
uint256 power = getVotingPower(voter);
emit VoteCast(voter, proposalId, power);
}
However an attacker can vote on someone's behalf even when the user s not willing to vote.
Impact
User's voting power can be used even if the user has no intention of voting.
Tools Used
Manual review
Recommendations
Allow only the owner to vote.
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
veRAACToken::recordVote lacks access control, allowing anyone to emit fake events
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.