Repository navigation
check_valid() accepts empty candidate lists and max_choices = 0 #35
Description
check_valid() does not guard against an empty candidates list or max_choices = 0. Both cases pass validation and produce a vote round where no meaningful vote can be cast, with no error surfaced to anyone.
File: rustsystem-server/src/proof/ballot.rs:77-88
Fix: Add self.candidates.is_empty() and self.max_choices == 0 guards.
Activity
HellFelix commentedon Apr 14, 2026
There is an equivalent guard on the frontend that enforces these same checks, but these are more meant as a convenience/UX nicety than a guard.
HellFelix commentedon Apr 14, 2026
Fixed with 8e33e66. Merged to stage with #64