RabbitHole Quest Protocol contest - vagrant's results

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleReceipt.sol#L98

Vulnerability details

Impact

The Owner can set the minterAddress at any point to an arbitrary address that is not the original QuestFactory via: https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleReceipt.sol#L83 An exploit could look like this:

1. The owner sets minterAddress to his own address
2. Mints infinite amount of receipts
3. Owner redeems them

Also possible, but less likely in my opinion: He could grief other participants via minting an infinte amount of tokens to participants address. This prevent them from successfully calling Quest.claim() due to transaction running out of gas: https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Quest.sol#L99 https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Quest.sol#L104 https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Quest.sol#L113

But simply setting the minterAddress to something other than the QuestFactory will already be sufficient since that will break QuestFactory.mintReceipt()

Proof of Concept

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleReceipt.sol#L83 An exploit could look like this:

1. The owner sets minterAddress to his own address
2. Mints infinite amount of receipts
3. Owner redeems them

Also possible, but less likely in my opinion: He could grief other participants via minting an infinte amount of tokens to participants address. This prevent them from successfully calling Quest.claim() due to transaction running out of gas: https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Quest.sol#L99 https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Quest.sol#L104 https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Quest.sol#L113

Tools Used

Manual Analysis

Recommended Mitigation Steps

I am not sure whether it is needed to have a function that can set the minterAddress after it has been set in Initialze(). Remove the setMinterAddress function if possible.