ERC1155 Quest allows for arbitrary rewardToken

[code423n4]

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/QuestFactory.sol#L106

Vulnerability details

Impact

Arbitrary reward tokens can seriously damage the projects reputation

Proof of Concept

During the function createQuest it allows any address with the CREATE_QUEST_ROLE role to create a new quest with a reward token. While there is a check in case of a ERC20 quest which ensures that the reward token is allowed:

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/QuestFactory.sol#L73

This check is missing for ERC1155 quests.

While this is not only a clear logical issue, this could furthermore damage the reputation of the project if quests are added with tokens that are not meant to be reward tokens, or useless tokens.

Tools Used

VSCode

Recommended Mitigation Steps

Consider adding the aforementioned check at the beginning of the function to ensure its checked for both, ERC20 and ERC1155 cases.

[c4-judge]

kirk-baird marked the issue as duplicate of #51

[c4-judge]

kirk-baird marked the issue as not a duplicate

[c4-judge]

kirk-baird changed the severity to QA (Quality Assurance)

[c4-sponsor]

waynehoover marked the issue as sponsor confirmed

[c4-judge]

kirk-baird marked the issue as grade-b