oasislabs / secret-ballot

Secret Ballot example dApp
Apache License 2.0
7 stars 7 forks source link

Voter fraud: unlimited ID creation / Sybil attack #16

Open bennetyee opened 5 years ago

bennetyee commented 5 years ago

https://github.com/oasislabs/secret-ballot/blob/9294f5a3dc13d129e477c7862476c028acb30aa2/contracts/confidential_SecretBallot.sol#L14

Anybody can vote, and there's no voter registration. An adversary can mechanize the process of creating new wallets and casting votes, at the cost of gas expended.