Possible to steal funds from another chains

[code423n4]

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/QuestFactory.sol#L215-L229

Vulnerability details

Impact

Current implementation of token vesting not resistant to:

1. Deploy this factory on different chains (you've noticed you're going to be multi-chain).
2. Deploy this factory on the same chain with different address.

Proof of Concept

1. You deployed factory to the Etherium, and held a competition with name "makeTransfer".
2. Users claimed tokens on the Etherium chain and know valid signature.
3. You launched on the Polygon network, and held a competition with the same name "makeTransfer".
4. Users may don't complete tasks on the Polygon network and just resubmit already known signature with hash. -- Here is critical error because user may cheat.

The same thing can happen if you deploy factory to the same network but to a new address, because your signature does not depend on the factory address.

Tools Used

Manual audit

Recommended Mitigation Steps

Use spec: https://eips.ethereum.org/EIPS/eip-712

See how it's implemented in Uniswap V2:
https://github.com/Uniswap/v2-core/blob/master/contracts/UniswapV2ERC20.sol
https://github.com/Uniswap/v2-core/blob/master/contracts/UniswapV2ERC20.sol#L29-L37
https://github.com/Uniswap/v2-core/blob/master/contracts/UniswapV2ERC20.sol#L81-L93

Do the same.

[c4-judge]

kirk-baird marked the issue as duplicate of #45

[c4-judge]

kirk-baird marked the issue as partial-25

[kirk-baird]

Partial credit as this is very poorly described.

[c4-judge]

kirk-baird changed the severity to 2 (Med Risk)

[c4-judge]

kirk-baird marked the issue as satisfactory