RabbitHole Quest Protocol contest - karanctf's results

A protocol to distribute token rewards for completing on-chain tasks.

General Information

Platform: Code4rena

Start Date: 25/01/2023

Pot Size: $36,500 USDC

Total HM: 11

Participants: 173

Period: 5 days

Judge: kirk-baird

Total Solo HM: 1

Id: 208

League: ETH

RabbitHole

Findings Distribution

Researcher Performance

Rank: 128/173

Findings: 1

Award: $11.33

Gas:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

[G-1]

On file QuestFactory.sol on line 72 and 105 instead of calculating constants like keccak256(abi.encodePacked('erc20'))) on the fly precalculate them and store to save gas like

if (keccak256(abi.encodePacked(contractType_)) == keccak256(abi.encodePacked('erc20'))) {
//0x5a28e9363bb942b639270062aa6bb295f434bcdfc42c97267bf003f272060dc9// as byte32
.
.
if (keccak256(abi.encodePacked(contractType_)) == keccak256(abi.encodePacked('erc1155'))) {

[G-2]

On claim() function after the tokens are checked which are claimed and which are not then memory array of token is passed in a function _setClaimed(tokens); to mark them claimed one by one.

function _setClaimed(uint256[] memory tokenIds_) private {

	for (uint i = 0; i < tokenIds_.length; i++) {

		claimedList[tokenIds_[i]] = true;

	}

}

Insted of this it can be done on the time of checking if they are claimed or not on line 106 It takes only memory array of tokens.

function claim() public virtual onlyQuestActive {

	if (isPaused) revert QuestPaused();

	uint[] memory tokens = rabbitHoleReceiptContract.getOwnedTokenIdsOfQuest(questId, msg.sender);

	if (tokens.length == 0) revert NoTokensToClaim();

	uint256 redeemableTokenCount = 0;

	for (uint i = 0; i < tokens.length; i++) {

		if (!isClaimed(tokens[i])) {

			redeemableTokenCount++;// also use preincrement here
++			claimedList[tokens[i]] = true;// set them here directly

		}

	}

if (redeemableTokenCount == 0) revert AlreadyClaimed();

uint256 totalRedeemableRewards = _calculateRewards(redeemableTokenCount);

_setClaimed(tokens);

_transferRewards(totalRedeemableRewards);

redeemedTokens += redeemableTokenCount;

emit Claimed(msg.sender, totalRedeemableRewards);

}

#0 - c4-judge

2023-02-06T09:21:07Z

kirk-baird marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter