RabbitHole Quest Protocol contest - kenta's results

A protocol to distribute token rewards for completing on-chain tasks.

General Information

Platform: Code4rena

Start Date: 25/01/2023

Pot Size: $36,500 USDC

Total HM: 11

Participants: 173

Period: 5 days

Judge: kirk-baird

Total Solo HM: 1

Id: 208

League: ETH

RabbitHole

Findings Distribution

Researcher Performance

Rank: 101/173

Findings: 1

Award: $17.20

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

1: startTime_ and endTime_ must be checked.

startTime_ must be earlier than endTime_. A validation for it is missing in createQuest.

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/QuestFactory.sol#L61

Add a new validation for the startTime_ and endTime_. if (startTime_ >= endTime_) revert InvalidQuestDuration:

2: check the input account_ if it is an empty address in grantDefaultAdminAndCreateQuestRole.

You need to deploy the contract again if the input account_ is an empty address because no account has the DEFAULT_ADMIN_ROLE and can not execute the grantRole.

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/QuestFactory.sol#L152-L155

Add the validation if the input account_ is empty or not.

if (account_ == address(0)) revert AddressZeroNotAllowd();

3 fix the typo for the comment in setRewardAllowlistAddress

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/QuestFactory.sol#L176

Replace remave with remove

#0 - kirk-baird

2023-02-06T09:06:57Z

All valid issues but insufficient quantity to qualify for grade-b

#1 - c4-judge

2023-02-06T09:07:03Z

kirk-baird marked the issue as grade-c

#2 - kirk-baird

2023-02-16T06:35:08Z

Upgrading to grade-b due to #505

#3 - c4-judge

2023-02-16T06:35:12Z

kirk-baird marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter