Core Contracts

Summary

The recordVote function in the veRAACToken contract is callable by anyone, it allows malicious actors to mark arbitrary addresses as having voted. This prevents legitimate users from voting.

Vulnerability Details

The recordVote function does not restrict who can call it. It only checks if the user has already voted on the specified proposal and updates the _hasVotedOnProposal mapping accordingly.

Since there is no access control and no modifiers or checks to restrict who can call it, any address can call this function with arbitrary parameters (voter and proposalId) to mark an address as having voted.

• If _hasVotedOnProposal[voter][proposalId] is false, the function:

  • Sets it to true

  • Retrieves the voter’s power via getVotingPower

  • Emits VoteCast

• If already true, it reverts with AlreadyVoted.

Impact

• Malicious actors can prevent legitimate users from voting by marking their addresses as having already voted.

Tools Used

Recommendations

• Restric access to maybe onlyVoteror onlyGovernanceor just add some form of access control