Skip to content

ALEO_ERROR_REPORT.md

Latest commit

 

History

History
44 lines (30 loc) · 2.51 KB

ALEO_ERROR_REPORT.md

File metadata and controls

44 lines (30 loc) · 2.51 KB
Raw

🛡️ Aleo Security & Integration Report: premium_voting_v3.aleo

This report documents a critical integration error and four major logic vulnerabilities found in the premium_voting_v3.aleo smart contract and its deployment.

1. 🛑 "Program Not Allowed" Error

Cause: This is a frontend/wallet permission error. When using the Aleo SDK or Leo Wallet, the DApp must explicitly request permission for every program it intends to interact with during the connect() phase. If you only requested credits.aleo, any call to premium_voting_v3.aleo will be blocked by the wallet.

Fix (Frontend): Ensure your connection request includes the program ID:

await wallet.connect("testnet", ["credits.aleo", "premium_voting_v3.aleo"]);

2. 🐛 Logic Vulnerabilities in premium_voting_v3.aleo

A. Double Voting Vulnerability

  • Issue: The vote_yes and vote_no functions only take a proposal_id. They do not check if the self.caller has already voted.
  • Impact: A single user can vote infinitely many times on the same proposal, rendering the voting results meaningless.

B. No Expiry Validation

  • Issue: While proposal_end_blocks is set during proposal creation, the finalize_vote functions never check block.height against this mapping.
  • Impact: Users can continue voting on proposals indefinitely, even after the intended deadline has passed.

C. Proposal Overwrite & Vote Reset

  • Issue: create_proposal_for_dao uses Mapping::set without checking if the proposal_id already exists.
  • Impact: A malicious actor (or accidental call) can overwrite an active proposal, resetting all yes_votes and no_votes back to zero and changing the end block.

D. Hardcoded Subscription Start

  • Issue: In subscribe_paid, the start_block is hardcoded to 0u32.
  • Impact: The Subscription record does not accurately reflect when the subscription began, making it difficult to calculate true expiration if duration_blocks is relative.

🛠️ Proposed Fixes (Leo Code)

The following changes should be implemented to secure the contract:

  1. Add voted_proposals mapping: Track hash(caller, proposal_id) to prevent double voting.
  2. Add Expiry Check: Ensure block.height <= Mapping::get(proposal_end_blocks, proposal_id).
  3. Add Existence Check: Ensure !Mapping::contains(proposals, proposal_id) before creating a new proposal.

See the updated premium_voting_v3.aleo source code in the repository for the implementation.