Quests pausable after ending

[code423n4]

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Quest.sol#L57-L58

Vulnerability details

Impact

The contract allows for quests to be paused after the endtime is up. A malicious owner may freeze the users claimable assets if he pauses the contract after it has ended and before users claim their rewards. To perform the attack the malicious admin just has to call the pause() function present at Quest.sol after the endtime was reached.

Proof of Concept

//Quest Starts start() //Quest Ends //Malicious admin issues a pause after ending pause() //users have their rewards frozen

Recommended Mitigation Steps

The pause() function at Quests.sol should have incorporated the following check:

if (block.timestamp >= endTime) revert QuestIsAlreadyOver();

[c4-judge]

kirk-baird changed the severity to QA (Quality Assurance)

[c4-sponsor]

waynehoover marked the issue as sponsor acknowledged

[c4-judge]

kirk-baird marked the issue as grade-b