Multi-Candidates election can be manipulated by submitting duplicate positions

[simpletrontdip]

Hi, while reading through the code, I've found out that submitVote did not check for the uniqueness of positions.
Since inside countVotes, we only find the position index and add the shares, so some voters can exploit this to manipulate the election's result, say:

submitVote(['A', 'A', 'A'])

// instead of
submitVote(['A', 'B', 'C'])

agoric-sdk/packages/governance/src/multiCandidateVoteCounter.js

Lines 68 to 76 in ca0b874

	for (const { chosen, shares } of allBallots.values()) {
	for (const position of chosen) {
	const positionIndex = positions.findIndex(p => keyEQ(p, position));
	if (positionIndex < 0) {
	spoiled += shares;
	} else {
	tally[positionIndex] += shares;
	}
	}

agoric-sdk/packages/governance/src/multiCandidateVoteCounter.js

Lines 168 to 183 in ca0b874

	submitVote(voterHandle, chosenPositions, shares = 1n) {
	chosenPositions.length <= maxChoices ||
	Fail`The number of choices exceeds the max choices.`;
	chosenPositions.forEach(position => {
	positionIncluded(positions, position) ||
	Fail`The specified choice is not a legal position: ${position}.`;
	});
	const completedBallot = harden({ chosen: chosenPositions, shares });
	allBallots.has(voterHandle)
	? allBallots.set(voterHandle, completedBallot)
	: allBallots.init(voterHandle, completedBallot);
	return completedBallot;
	},

[simpletrontdip]

Something like this may help

        const chosenCount = chosenPositions.length;
        const uniqueCount = new Set(chosenPositions).size;

        chosenCount === uniqueCount ||
          Fail`Duplicated positions found`;

[Chris-Hibbert]

I created an issue #6721. Thanks for reporting this!