Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Unauthorized Vote Recording in veRAACToken

bbash

Summary

The recordVote function in veRAACToken allows anyone to record a vote for any user. This enables an attacker to falsely mark a user as having voted, preventing them from casting their actual vote. The issue arises due to the absence of an access control mechanism in the function.

Vulnerability Details

The function recordVote() does not verify if the caller (msg.sender) is the same as the voter.
Any external user can call recordVote(voter, proposalId), updating _hasVotedOnProposal[voter][proposalId] = true.
This prevents the actual voter from participating in governance.

The issue can be found here:

https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/tokens/veRAACToken.sol#L408-L417

function recordVote(
address voter,
uint256 proposalId
) external {
if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
_hasVotedOnProposal[voter][proposalId] = true;
uint256 power = getVotingPower(voter);
emit VoteCast(voter, proposalId, power);
}

Impact

Attackers can selectively block users from voting by marking them as already voted. Malicious actors could manipulate governance decisions by preventing key stakeholders from voting.

Tools Used

Manual Review

Recommendations

Modify recordVote() to allow only the voter to record their own vote.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::recordVote lacks access control, allowing anyone to emit fake events

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.