Core Contracts

Summary

The veRAACToken::recordVote has no restrictions on which proposal is being passed, which will emit an incorrect event in case of a non-exsistent proposal. Even if we consider this as dead code, the incorrect event spam is inevitable.

Vulnerability Details

The veRAACToken::recordVote function is primarily used for recording vote using the voting power of the users, the event is emitted showcasing the weightage of the vote.

However, the issue lies in lack of restrictions provided here as any non-exsistent proposal can be passed an voted onto, emitting an incorrect event.

Impact

1. Emits an event which is incorrect as the proposalId which is being voted here does not even exists.

2. Even if this code is considered to be dead code, malicious actor can still spam incorrect event multiple times.

Proof of Concept

Add the following test case inside the veRAACToken.test.js file:

Tools Used

Manual Review
/
Hardhat

Recommendations

Either restrict proposal votes to only proposals which have been proposed (the whole code has to be re-worked / finished) or if this is dead code, kindly remove to avoid event spams.