Exponential Inflation of Voice Credits in Quadratic Voting Strategy
In the given code snippet, we observe a potential issue in the way voice credits are being accumulated for each recipient. The specific lines of code in question are:\\n```\\nfunction _qv_allocate(\\n        // rest of code\\n    ) internal onlyActiveAllocation {\\n        // rest of code\\n        uint256 creditsCastToRecipient = _allocator.voiceCreditsCastToRecipient[_recipientId];\\n        // rest of code\\n        // get the total credits and calculate the vote result\\n        uint256 totalCredits = _voiceCreditsToAllocate + creditsCastToRecipient;\\n        // rest of code\\n        //E update allocator mapping voice for this recipient\\n        _allocator.voiceCreditsCastToRecipient[_recipientId] += totalCredits; //E @question should be only _voiceCreditsToAllocate\\n        // rest of code\\n    }\\n```\\n\\nWe can see that at the end :\\n```\\n_allocator.voiceCreditsCastToRecipient[_recipientId] = _allocator.voiceCreditsCastToRecipient[_recipientId] + _voiceCreditsToAllocate +  _allocator.voiceCreditsCastToRecipient[_recipientId];\\n```\\n\\nHere, totalCredits accumulates both the newly allocated voice credits (_voiceCreditsToAllocate) and the credits previously cast to this recipient (creditsCastToRecipient). Later on, this totalCredits is added again to `voiceCreditsCastToRecipient[_recipientId]`, thereby including the previously cast credits once more\\nProof of Concept (POC):\\nLet's consider a scenario where a user allocates credits in three separate transactions:\\nTransaction 1: Allocates 5 credits\\ncreditsCastToRecipient initially is 0\\ntotalCredits = 5 (5 + 0)\\nNew voiceCreditsCastToRecipient[_recipientId] = 5\\nTransaction 2: Allocates another 5 credits\\ncreditsCastToRecipient now is 5 (from previous transaction)\\ntotalCredits = 10 (5 + 5)\\nNew voiceCreditsCastToRecipient[_recipientId] = 15 (10 + 5)\\nTransaction 3: Allocates another 5 credits\\ncreditsCastToRecipient now is 15\\ntotalCredits = 20 (5 + 15)\\nNew voiceCreditsCastToRecipient[_recipientId] = 35 (20 + 15)\\nFrom the above, we can see that the voice credits cast to the recipient are exponentially growing with each transaction instead of linearly increasing by 5 each time
Code should be modified to only add the new voice credits to the recipient's tally. The modified line of code should look like:\\n```\\n_allocator.voiceCreditsCastToRecipient[_recipientId] += _voiceCreditsToAllocate;\\n```\\n
Exponential increase in the voice credits attributed to a recipient, significantly skewing the results of the voting strategy( if one recipient receive 15 votes in one vote and another one receive 5 votes 3 times, the second one will have 20 votes and the first one 15) Over time, this could allow for manipulation and loss of trust in the voting mechanism and the percentage of amount received by recipients as long as allocations are used to calculate the match amount they will receive from the pool amount.
```\\nfunction _qv_allocate(\\n        // rest of code\\n    ) internal onlyActiveAllocation {\\n        // rest of code\\n        uint256 creditsCastToRecipient = _allocator.voiceCreditsCastToRecipient[_recipientId];\\n        // rest of code\\n        // get the total credits and calculate the vote result\\n        uint256 totalCredits = _voiceCreditsToAllocate + creditsCastToRecipient;\\n        // rest of code\\n        //E update allocator mapping voice for this recipient\\n        _allocator.voiceCreditsCastToRecipient[_recipientId] += totalCredits; //E @question should be only _voiceCreditsToAllocate\\n        // rest of code\\n    }\\n```\\n