withdrawBounty the same bounty multiple times

[code423n4]

Handle

pauliax

Vulnerability details

Impact

The same bounty can be claimed multiple times as it remains active. 'bounty' points to the memory variable, so its state is not persisted: Bounty memory bounty = _bounties[bountyIds[i]]; require(bounty.active); IERC20(bounty.token).transfer(msg.sender, bounty.amount); bounty.active = false;

Recommended Mitigation Steps

A simple solution would be to use a storage pointer instead: Bounty storage bounty = _bounties[bountyIds[i]];

[frank-beard]

duplicate of https://github.com/code-423n4/2021-09-defiprotocol-findings/issues/168

[GalloDaSballo]

Duplicate of #168

[GalloDaSballo]

I ended up downgrading this finding as well as marking as duplicate because the warden didn't specify any attack vector via the vulnerability.