RabbitHole Quest Protocol contest - M4TZ1P's results

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Erc20Quest.sol#L102-L104

Vulnerability details

Impact

Since there is no code to check whether fee has been drawn, withdrawFee() might be called multiple times. This allows protocolFeeRecipient to steal all of the unclaimed reward tokens after quest ended.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

Sublime Text

Recommended Mitigation Steps

Add a code to confirm that the fee can be withdrawn only once as shown below.

bool public withdrawal = false;

function withdrawFee() public onlyAdminWithdrawAfterEnd {
		require(withdrawal == false, "already took withdraw fee");
		withdrawal = true;
		IERC20(rewardToken).safeTransfer(protocolFeeRecipient, protocolFee()); 
}

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Erc20Quest.sol#L81-L87

Vulnerability details

Impact

mintReceipt could mint receipt after endtime. If owner execute withdrawRemainingTokens user’s receipt that mint after endtime can’t claim.

Proof of Concept

function withdrawRemainingTokens(address to_) public override onlyOwner {
        super.withdrawRemainingTokens(to_);

        uint unclaimedTokens = (receiptRedeemers() - redeemedTokens) * rewardAmountInWeiOrTokenId;
        uint256 nonClaimableTokens = IERC20(rewardToken).balanceOf(address(this)) - protocolFee() - unclaimedTokens;
        IERC20(rewardToken).safeTransfer(to_, nonClaimableTokens);
    }

withdrawRemainingTokens withdraw all of fund in Quest except unredeemedToken. unredeemedToken doesn’t contain unminted receipt so when mint receipt after withdrawRemainingTokens are unclaimable.

Tools Used

Sublime Text

Recommended Mitigation Steps

prevent receipt after endtime or withdrawRemainingTokens.