Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Anyone can record vote on behalf of anyone else

tejaswarambhe

Summary

The veRAACToken::recordVote has no restrictions, allowing an malicious actor to record vote on any proposal on behalf of anyone.

Vulnerability Details

The veRAACToken::recordVote function is primarily used for recording vote using the voting power of the users, the event is emitted showcasing the weightage of the vote.

function recordVote(
address voter,
uint256 proposalId
) external {
if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
_hasVotedOnProposal[voter][proposalId] = true; <<@ - // Lack of restrictions
uint256 power = getVotingPower(voter);
emit VoteCast(voter, proposalId, power);
}

However, the issue lies in lack of restrictions provided here as any malicious actor would record vote on behalf of anyone and can fully disrupt the voting mechanism by gaming the system.

Impact

  1. Allows a malicious actor to vote on a proposal on behalf of anyone.

  2. Malicious actor can game the entire voting system onto their own favour to gain significant advantage for passing their desired proposal.

Proof of Concept

Add the following test case inside the veRAACToken.test.js file:

describe("Anyone can record vote", async () => {
it("should allow anyone to record a vote on behalf of a user", async () => {
await veRAACToken.connect(users[0]).lock(ethers.parseEther("1000"), 365 * 24 * 3600);
// cast vote on behalf of user 0
await veRAACToken.connect(users[1]).recordVote(users[0].address, 1);
});
})

As we can see, users[1] was able to record vote on behalf of users[0].

Tools Used

Manual Review
/
Hardhat

Recommendations

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::recordVote lacks access control, allowing anyone to emit fake events

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.