RabbitHole Quest Protocol contest - mrpathfindr's results

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Erc20Quest.sol#L102

Vulnerability details

Impact

Detailed description of the impact of this finding.

Unauthorised or unintended user can trigger protocolFeeRecipient funds to be sent to the protocolFeeRecipient.

An attacker can use vulnerability to slow down/ holt business operations due to discrepancies between the caller and receiver of funds.

Since the intended recipient is clearly defined, the intended caller should be the only entity capable of triggering the function.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Erc20Quest.sol#L102

Tools Used

Manual Search

Recommended Mitigation Steps

Apply modifier to ensure only the protocolFeeRecipient can call the withdrawFee() function.

Do this

    modifier onlyOwner() {
        require(msg.sender == protocolFeeRecipient, "Not protocolFeeRecipient!");
        _;
    }


  /// @notice Sends the protocol fee to the protocolFeeRecipient
    /// @dev Only callable when the quest is ended and if msg.sender is protocolFeeRecipient

    function withdrawFee() public onlyprotocolFeeRecipient onlyAdminWithdrawAfterEnd {
        IERC20(rewardToken).safeTransfer(protocolFeeRecipient, protocolFee());
    }

Instead of this

  /// @notice Sends the protocol fee to the protocolFeeRecipient

    function withdrawFee() public onlyprotocolFeeRecipient onlyAdminWithdrawAfterEnd {
        IERC20(rewardToken).safeTransfer(protocolFeeRecipient, protocolFee());
    }