Submission Details
Severity:
An attacker can call `veRAACToken.sol::recordVote()` on behalf of voter, leading to unintended vote to a proposal.
Summary
The recordVote() function is used to track user vote, but it can be called by anyOne.
function recordVote(
address voter,
uint256 proposalId
) external {
if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
_hasVotedOnProposal[voter][proposalId] = true;
uint256 power = getVotingPower(voter);
emit VoteCast(voter, proposalId, power);
}
Vulnerability Details
An attacker can call
recordVote()function without voter consent.Means even if voter doesn't wishes to vote; his vote is being used in proposal favor.
An attacker can create a malicious proposal and then do above process.
Causing threat to protocol's system.
Impact
voting on malicious proposal without user consent .
Tools Used
Manual
Recommendations
replace _hasVotedOnProposal[voter][proposalId] with _hasVotedOnProposal[msg.sender][proposalId]
Updates
Lead Judging Commences
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
veRAACToken::recordVote lacks access control, allowing anyone to emit fake events
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.