Submission Details
Severity:
Users can record vote even if they don't have any voting power
Summary
Users can record vote even if they don't have any voting power
Vulnerability Details
Following is record vote function
function recordVote(
address voter,
uint256 proposalId
) external {
if (_hasVotedOnProposal[voter][proposalId]) revert AlreadyVoted();
_hasVotedOnProposal[voter][proposalId] = true;
uint256 power = getVotingPower(voter);
emit VoteCast(voter, proposalId, power);
}
// View functions
/**
* @notice Gets the current voting power for an account
* @dev Calculates voting power based on lock amount and remaining time
* @param account The address to check voting power for
* @return The current voting power of the account
*/
function getVotingPower(address account) public view returns (uint256) {
return _votingState.getCurrentPower(account, block.timestamp);
}
The above function doesn't checks that if the user has voting power or not therefore anyone can record vote without even having voting power.
Impact
Anyone can record vote.
Tools Used
Recommendations
Check for non zero voting power.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.