Platform: Code4rena
Start Date: 25/01/2023
Pot Size: $36,500 USDC
Total HM: 11
Participants: 173
Period: 5 days
Judge: kirk-baird
Total Solo HM: 1
Id: 208
League: ETH
Rank: 117/173
Findings: 1
Award: $17.20
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: CodingNameKiki
Also found by: 0x1f8b, 0x4non, 0x5rings, 0xAgro, 0xMirce, 0xRobocop, 0xSmartContract, 0xackermann, AkshaySrivastav, ArmedGoose, Aymen0909, BClabs, Breeje, Dewaxindo, Diana, HollaDieWaldfee, IceBear, IllIllI, Iurii3, Josiah, Krayt, PaludoX0, Phenomana, PrasadLak, RaymondFam, Rolezn, SaeedAlipoor01988, SaharDevep, SleepingBugs, adriro, arialblack14, bin2chen, brevis, btk, carlitox477, carrotsmuggler, catellatech, chaduke, chrisdior4, cryptonue, cryptostellar5, csanuragjain, ddimitrov22, fellows, glcanvas, halden, hl_, horsefacts, jat, joestakey, kenta, libratus, lukris02, luxartvinsec, manikantanynala97, martin, matrix_0wl, nadin, nicobevi, oberon, peanuts, prestoncodes, rbserver, sakshamguruji, sashik_eth, sayan, seeu, thekmj, tnevler, trustindistrust, tsvetanovv, xAriextz, zadaru13, zaskoh
17.196 USDC - $17.20
The _transferRewards() function does not check if the quest has ended, which could allow an attacker to claim rewards before the quest has ended.
Severity: Low
PoC function exploit() public { Erc20Quest quest = Erc20Quest(<address of deployed contract>); quest._transferRewards(<address of attacker>, <amount>); }
#0 - c4-judge
2023-02-05T06:17:11Z
kirk-baird marked the issue as grade-c
#1 - kirk-baird
2023-02-16T06:53:37Z
This was rated grade-c due to quality but I will upgrade to grade-b due to #374
#2 - c4-judge
2023-02-16T06:53:41Z
kirk-baird marked the issue as grade-b