Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

[H] Missing Authorization Check in `recordVote` Function in `veRAACToken`

Singularity

Summary

The recordVote function in the veRAACToken contract does not check the msg.sender, allowing anyone to call this function with any voter address. This can lead to unauthorized recording of votes.

Vulnerability Details

The current recordVote function in the veRAACToken contract is:

function recordVote(
address voter,
uint256 proposalId
) external {
if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
_hasVotedOnProposal[voter][proposalId] = true;
​
uint256 power = getVotingPower(voter);
emit VoteCast(voter, proposalId, power);
}

The function does not check the msg.sender, allowing anyone to call this function with any voter address.

Links:

  1. https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/veRAACToken.sol#L413

Impact

This bug can lead to unauthorized recording of votes, potentially compromising the integrity of the voting process within the protocol.

Tools Used

Manual code review.

Recommendations

Add an authorization check to ensure that only authorized addresses can call the recordVote function. The corrected function should be:

function recordVote(
address voter,
uint256 proposalId
) external onlyAuthorized {
if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
_hasVotedOnProposal[voter][proposalId] = true;
​
uint256 power = getVotingPower(voter);
emit VoteCast(voter, proposalId, power);
}

Additionally, define the onlyAuthorized modifier to restrict access to the function:

modifier onlyAuthorized() {
require(msg.sender == authorizedAddress, "Not authorized");
_;
}

This ensures that only authorized addresses can call the recordVote function, maintaining the integrity of the voting process.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::recordVote lacks access control, allowing anyone to emit fake events

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::recordVote lacks access control, allowing anyone to emit fake events

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.