Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Malicious user can call veRAACToken.recordVote() on behalf of other users

elser17

Summary

Malicious user can call veRAACToken.recordVote() on behalf of other users

Vulnerability Details

veRAACToken.recordVote() can be called by anybody to make input address vote for a given proposalId, emitting an event with the current votingPower of voter. A malicious user could take advantage and use another users' votingPower to vote for proposals malicious user is interested in without voter's permission. It can also limit the voter by voting a proposalId with a lower votingPower than voter would like to have when voting, as a voter cannot vote twice for the same proposal.

Impact

votingPower loses its value as any user can use others' votingPower. Malicious user can act to support desired proposals with others' votingPower or prevent them from voting a given proposalId by calling `_hasVotedOnProposal[voter][proposalId]`when user has little votingPower.

Tools Used

Manual review

Recommendations

Only allow a user to vote using their own voting power, not others':

function recordVote(
- address voter,
uint256 proposalId
) external {
- if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
+ if (_hasVotedOnProposal[msg.sender][proposalId]) revert AlreadyVoted();
- _hasVotedOnProposal[voter][proposalId] = true;
+ _hasVotedOnProposal[msg.sender][proposalId] = true;
- uint256 power = getVotingPower(voter);
+ uint256 power = getVotingPower(msg.sender);
- emit VoteCast(voter, proposalId, power);
+ emit VoteCast(msg.sender, proposalId, power);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::recordVote lacks access control, allowing anyone to emit fake events

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

veRAACToken::recordVote lacks access control, allowing anyone to emit fake events

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.