Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Potential Issue in `recordVote` Function of `veRAACToken` Contract

bwrauncge

Summary

The recordVote function in the veRAACToken contract indeed has potential issues, particularly regarding its functionality and security.

Vulnerability Details

Lines:

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/veRAACToken.sol#L408

function recordVote(
address voter,
uint256 proposalId
) external {
if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
_hasVotedOnProposal[voter][proposalId] = true;
​
uint256 power = getVotingPower(voter);
emit VoteCast(voter, proposalId, power);
}

  1. Lack of Functionality:

    The recordVote function is intended to record a vote for a proposal, but it does not actually perform any meaningful action beyond marking that the voter has voted on a specific proposal.

  2. Missing Access Control:

    The function lacks any form of access control, meaning that any external entity can call it. This could lead to unauthorized users being able to record votes on behalf of others or manipulate the voting process.

Impact

Without proper access control, malicious actors could exploit this function to cast votes without authorization, potentially skewing the results of proposals.

Tools Used

Manual Review

Recommendations

Recommend checking whether this function is intended needed. Otherwise, it should be modified to prevent abuse.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::recordVote lacks access control, allowing anyone to emit fake events

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::recordVote lacks access control, allowing anyone to emit fake events

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.