The same bounty can be claimed multiple times as it remains active. 'bounty' points to the memory variable, so its state is not persisted:
Bounty memory bounty = _bounties[bountyIds[i]];
require(bounty.active);
IERC20(bounty.token).transfer(msg.sender, bounty.amount);
bounty.active = false;
Recommended Mitigation Steps
A simple solution would be to use a storage pointer instead:
Bounty storage bounty = _bounties[bountyIds[i]];
Handle
pauliax
Vulnerability details
Impact
The same bounty can be claimed multiple times as it remains active. 'bounty' points to the memory variable, so its state is not persisted: Bounty memory bounty = _bounties[bountyIds[i]]; require(bounty.active); IERC20(bounty.token).transfer(msg.sender, bounty.amount); bounty.active = false;
Recommended Mitigation Steps
A simple solution would be to use a storage pointer instead: Bounty storage bounty = _bounties[bountyIds[i]];