Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Vote Griefing Through Unrestricted `recordVote` Function

skidd0016

Link to Affected Code:

VOTE

function recordVote(
address voter,
uint256 proposalId
) external {
if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
// @audit no access control
_hasVotedOnProposal[voter][proposalId] = true;
uint256 power = getVotingPower(voter);
emit VoteCast(voter, proposalId, power);
}

Description:
The recordVote function lacks access control mechanisms, allowing any address to record votes on behalf of other users. This enables malicious actors to mark legitimate voters as having already voted before they can actually cast their vote, effectively censoring their voting power.

Impact:

  1. Voter censorship through preemptive vote recording

  2. Manipulation of governance outcomes by blocking strategic voters

  3. No way for legitimate voters to override the griefing

Proof of Concept:
It can happen following this steps:

  1. An attacker calls the the recordVote function with address they want to grief

  2. The function passes because there is no access control and the function set _hasVotedOnProposal[voter][proposalId] = true;

  3. When a legitimate user that was griefed tries to vote , this call reverts if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
    So they cant vote for a proposal because it was recorded in the system that they already voted!

Recommended Mitigation:

Add msg.sender validation:

function recordVote(uint256 proposalId) external {
if (_hasVotedOnProposal[msg.sender][proposalId]) revert AlreadyVoted();
_hasVotedOnProposal[msg.sender][proposalId] = true;
uint256 power = getVotingPower(msg.sender);
emit VoteCast(msg.sender, proposalId, power);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::recordVote lacks access control, allowing anyone to emit fake events

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.