RabbitHole Quest Protocol contest - vanko1's results

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleReceipt.sol#L58-L61 https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleTickets.sol#L47-L50

Vulnerability details

Impact

In both RabbitHoleReceipt.sol and RabbitHoleTickets.sol the usage of the onlyMinter modifier is essentially useless and everyone can call functions that are not intended to be called by everyone. Examples are mint in and mintBatch in the mentioned contracts. This can lead to manipulation of other parts in the protocol and would make extracting value from given quest practically impossible.

Proof of Concept

The modifier code is invalid as it does not check properly the minter address

Tools Used

VsCode

Recommended Mitigation Steps

Rewrite the modifier like this:

    modifier onlyMinter() {
        if(msg.sender != minterAddress) revert OnlyMinter();
        _;
    }