Open code423n4 opened 1 year ago
kirk-baird changed the severity to QA (Quality Assurance)
This previously downgraded issue has been upgraded by kirk-baird
This previously downgraded issue has been upgraded by kirk-baird
kirk-baird marked the issue as duplicate of #630
kirk-baird marked the issue as satisfactory
kirk-baird marked the issue as selected for report
waynehoover marked the issue as sponsor disputed
We have a rewardAllowlist
in which we will not include rebasing tokens, our protocol does not support rebasing tokens.
Reward allow list is a genuine solution to prevent rebasing and FoT tokens and so I'm going to downgrade this to a QA.
I'd also recommend clearly documenting the rebasing and FoT tokens will not be allowed.
kirk-baird changed the severity to QA (Quality Assurance)
kirk-baird marked the issue as grade-a
kirk-baird marked the issue as not selected for report
Lines of code
https://github.com/rabbitholegg/quest-protocol/blob/main/contracts/Erc20Quest.sol#L66-L68 https://github.com/rabbitholegg/quest-protocol/blob/main/contracts/Erc20Quest.sol#L81-L87 https://github.com/rabbitholegg/quest-protocol/blob/main/contracts/Erc20Quest.sol#L102-L104
Vulnerability details
Impact
When a rebasing token is used as the reward token for an ERC20 quest, it is possible that this token's rebasing event, which reduces its balance owned by the
Erc20Quest
contract, occurs before the followingErc20Quest._transferRewards
,Erc20Quest.withdrawRemainingTokens
, andErc20Quest.withdrawFee
functions are called. When this occurs, calling these transfer functions can revert due to insufficient balance of this rebasing reward token owned by theErc20Quest
contract. As a result, the reward token amounts that suppose to be received by the RabbitHole receipt holders, quest owner, and/or protocol fee recipient cannot be transferred.https://github.com/rabbitholegg/quest-protocol/blob/main/contracts/Erc20Quest.sol#L66-L68
https://github.com/rabbitholegg/quest-protocol/blob/main/contracts/Erc20Quest.sol#L81-L87
https://github.com/rabbitholegg/quest-protocol/blob/main/contracts/Erc20Quest.sol#L102-L104
Proof of Concept
The following steps can occur for one of the described scenarios.
Erc20Quest
contract.claim
function for this quest but this function call reverts because the rebasing reward token's balance owned by theErc20Quest
contract is now insufficient to cover her reward token amount. Hence, she is unable to receive the reward token amount associated with her RabbitHole receipt.Tools Used
VSCode
Recommended Mitigation Steps
Like some other protocols, this protocol does not have to support rebasing tokens. A blocklist can be used to block the usage of these tokens. If blocking these tokens, please explicitly document it so users know about this.