All the Funds in the contract can be drained by the protocolFeeRecipient after the Quest is Ended

[code423n4]

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Erc20Quest.sol#L100-L104

Vulnerability details

Impact

 In the ERC20Quest Contract, the withdrawFee() function can be called after the quest is ended and if the contract has funds that are not claimed 
by the claimers, by that time this function can be called and claim all the remaining funds in the contract.

Proof of Concept

  For example, suppose there are 101 tokens in the contract so 100 tokens are been allocated to claimers and 1 token to the protocolFeeRecipient 
  and after the Quest Ends, they are 50 tokens unclaimed by claimers and 1 token for protocolFeeRecipient, and now the withdrawFee() function 
  can be called a few times and all 51 tokens can be claimed by the protocolFeeRecipient.

Tools Used

 Pen and paper

Recommended Mitigation Steps

 Have a check that the function should only be called once basically like having a variable like bool  protocolFeeRecipientClaimedFees =  false 
 initially and once the  withdrawFee() function is called after the quest then make it protocolFeeRecipientClaimedFees =  true and basically if it 
 called again revert it because the Fee is already claimed.

[c4-judge]

kirk-baird marked the issue as duplicate of #23

[c4-judge]

kirk-baird marked the issue as partial-50

[kirk-baird]

Partial credit due to low quality of write-up

[c4-judge]

kirk-baird marked the issue as satisfactory