RabbitHole Quest Protocol contest - badman's results

A protocol to distribute token rewards for completing on-chain tasks.

General Information

Platform: Code4rena

Start Date: 25/01/2023

Pot Size: $36,500 USDC

Total HM: 11

Participants: 173

Period: 5 days

Judge: kirk-baird

Total Solo HM: 1

Id: 208

League: ETH

RabbitHole

Findings Distribution

Researcher Performance

Rank: 141/173

Findings: 1

Award: $10.80

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

10.8031 USDC - $10.80

Labels

bug
2 (Med Risk)
partial-50
duplicate-601

External Links

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/QuestFactory.sol#L219-L230

Vulnerability details

Impact

User can mint erc721 rabbitholeReceiptContract NFT eventhough the quest has ended, this can happen because the mintReceipt() didn't check the endtime of the quest, and just minted it if the participant hasn't applied yet. therefore a quest that already deprecated are still allowed to be minted.

Proof of Concept

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/QuestFactory.sol#L219-L230

check the the endTime of the quest id before mint the NFT

#0 - c4-judge

2023-02-05T05:33:36Z

kirk-baird marked the issue as duplicate of #22

#1 - c4-judge

2023-02-05T05:33:40Z

kirk-baird marked the issue as partial-50

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter