Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`veRAACToken::recordVote` function lacks access control

maa_ly

Summary

The recordVote function is external and doesn't have any access controls. Anyone can call it and mark any address as having voted on a proposal. There's no check to ensure that only the governance contract or the voter themselves can call this function. An attacker could repeatedly call this function for different voters and proposals, effectively blocking legitimate votes. This would disrupt governance processes and could lead to proposals being decided without proper participation, undermining the decentralized governance model.

Vulnerability Details

Missing permission checks let attackers call recordVote directly:

function recordVote(address voter, uint256 proposalId) external {
_hasVotedOnProposal[voter][proposalId] = true; // No auth
}

Impact

Attackers can block legitimate voters by marking their addresses as "already voted."

Tools Used

manual review

Recommendations

Add access control

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::recordVote lacks access control, allowing anyone to emit fake events

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!