> For the complete documentation index, see [llms.txt](https://reports.immunefi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://reports.immunefi.com/zano-iop/40794-w-and-a-insight-unsecured-wallet-voting-configuration-allows-unauthorized-vote-manipulation-de.md).

# #40794 \[W\&A-Insight] Unsecured Wallet Voting Configuration Allows Unauthorized Vote Manipulation Des

**Submitted on Mar 4th 2025 at 00:15:44 UTC by @jovi for** [**IOP | Zano**](https://immunefi.com/audit-competition/iop-zano)

* **Report ID:** #40794
* **Report Type:** Websites and Applications
* **Report severity:** Insight
* **Target:** <https://github.com/immunefi-team/zano-iop/blob/main/src/wallet/wallets\\_manager.cpp>
* **Impacts:**
  * Taking and/modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as:
* Changing registration information
* Commenting
* Voting
* Making trades
* Withdrawals, etc.

## Description

**Summary**\
On a machine running multiple locally accessed wallets, an attacker without the wallet password can still change the wallet's voting configuration. This is unintended since each wallet is password-protected, and such changes should be impossible without the correct password.

***

## Vulnerability Details

**Location**\
In `wallets_manager.cpp`, the wallet software sets a single `votes_config_path` (for example, `"voting.json"`) that is not protected by any wallet password checks.

**Description**

* **Cause**: The wallet’s votes are stored outside the encrypted wallet file and loaded at runtime without further password enforcement.
* **Expected Behavior**: Changing a wallet’s votes should require its password.
* **Observed Behavior**: A local user with file-system access can edit this config file and cause wallet's they don't own the password to cast new or altered votes, even though they have never provided the wallet password.

**Code Snippet**

```cpp
void wallets_manager::init_wallet_entry(wallet_vs_options& wo, uint64_t id)
{
  ...
  // Sets an unprotected config path for votes
  wo.w->get()->set_votes_config_path(m_data_dir + "/" + CURRENCY_VOTING_CONFIG_DEFAULT_FILENAME);
  ...
}
```

No subsequent checks enforce the wallet’s password when reading or applying that file.

**Impact**\
An unauthorized individual can override or add votes in a wallet they do not own, compromising user autonomy in on-chain decision or governance processes.

## Proof of Concept

1. The attacker has local file-system access on a system hosting multiple wallets.
2. They locate the shared “voting.json” file (or its variant).
3. They modify it with their desired votes.
4. All the local wallets subsequently broadcast these changes in newly minted blocks or normal transactions—no password prompts occur.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://reports.immunefi.com/zano-iop/40794-w-and-a-insight-unsecured-wallet-voting-configuration-allows-unauthorized-vote-manipulation-de.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.