Submission Details
Severity:
Votes Can Be Recorded by Anyone for Any User on Any Proposal ID
Description
There are no checks to validate who can record votes for whom and for which proposal IDs. As a result, anybody can record votes for any voter address they want even though said voter might not have even voted for that proposalId
// https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/veRAACToken.sol#L408-L417
function recordVote(
address voter,
uint256 proposalId
) external {
if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
_hasVotedOnProposal[voter][proposalId] = true;
uint256 power = getVotingPower(voter);
emit VoteCast(voter, proposalId, power);
}
Recommendations
Ensure that only authorized parties can record votes on behalf of voters and for the correct proposal ID
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
veRAACToken::recordVote lacks access control, allowing anyone to emit fake events
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.