Core Contracts

Summary

The recordVote() in veRAACToken.sol allows any external caller to mark an arbitrary address as having voted on a proposal. This lack of verification means that an attacker can record a vote on behalf of any address without proper authorization.

Vulnerability Details

• Function Behavior: The recordVote() function takes two parameters—a voter address and a proposalId. It first checks if the specified address has already voted on that proposal. If not, it marks the address as having voted and emits a VoteCast event that includes the voter’s voting power.

• Lack of Caller Verification: There is no requirement that the caller (msg.sender) matches the voter address provided as a parameter. This oversight enables an attacker to submit votes on behalf of any user.

Code Snippet from veRAACToken.sol:

Impact

• Confusion and Storage Changes: Although this does not directly interfere with governance, the bug nonetheless allows state changes that are illegitimate.

• Future Integration Risk: If the _hasVotedOnProposal mapping was ever integrated into the governance process in the future there would be significant problems without addressing this bug. For example, an attacker could preemptively record votes for any address, preventing legitimate voters from casting their votes and potentially skewing the outcome of governance decisions and unauthorized vote recording could lead to manipulated vote counts and malicious governance outcomes.

Tools Used

Manual review

Recommendations

Restrict Caller Authority: Modify the function to ensure that only the intended voter can record their own vote. For example, add a check such as: require(msg.sender == voter, "Caller must be the voter"); Alternatively, use signature verification to authenticate the voter.

• Strengthen Authorization Controls: Implement role-based access control or multisignature schemes to ensure that vote recording can only be performed by authorized entities.

• Comprehensive Testing and Auditing: Perform extensive testing and security audits on all vote-related functions to ensure that no unauthorized vote manipulation is possible.