Admins may withdraw funds dedicated to previously minted receipts #55
Labels
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
bug
Something isn't working
downgraded by judge
Judge downgraded the risk level of this issue
duplicate-528
satisfactory
satisfies C4 submission criteria; eligible for awards
Lines of code
https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Erc1155Quest.sol#L54-L63
Vulnerability details
Impact
Admins may withdraw tokens from quests even though there are remaining unclaimed receipts. This leads to a loss of funds for the receipt holders.
Proof of Concept
In Erc20Quest, there are checks that ensure that even on admin withdrawal, sufficient funds remain to cover already-minted but yet-unclaimed receipts: https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Erc20Quest.sol#L78-L87
However, in Erc1155Quest there are no such checks: https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Erc1155Quest.sol#L54-L63
For Erc1155Quests, admin withdrawal will cause loss of funds for holders of minted but unclaimed receipts. This seems to be an error as there are checks in Erc20Quest that guard against this.
Tools Used
Manual review.
Recommended Mitigation Steps
Change the admin withdrawal amount in Erc1155Quest such on withdrawal, (protocolFees + unclaimedTokenRewards) num of rewardTokens are left behind for currently minted but unclaimed receipts.
The text was updated successfully, but these errors were encountered: