RabbitHole Quest Protocol contest - cryptojedi88's results

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Quest.sol#L96

Vulnerability details

Impact

The function claim() in Quest.sol calls the RabbitHoleReceipt.sol function getOwnedTokenIdsOfQuest() in order to get an array of the reward tokens associated with the claimant. In total, the function has 3 for loops (2 in getOwnedTokenIdsOfQuest() function and 1 in claim() function). There is a scenario where a malicious or a non-malicious actor could (unintentionally) execute a Gas Griefing attack on this contract, causing unintended consequences and missed rewards for the claimants who have completed the tasks on-chain.

This could happen because of the gas limit on the Ethereum blockchain, where the for loops might stop executing / revert in case the claimant has a lot of claimable tokens (say >200). While this scenario is less likely to happen under normal circumstances, there might be a case where someone sweeps a number of reward tokens from the secondary market, and calls the claim() function to redeem their rewards.

Recommended Mitigation Steps

It is recommended to batch the claiming requests and limit the number of tokens that could be claimed in any single call to the contract. This could be maybe 40 or 50 tokens at a time (need to do some testing to come up an optimum number).