search

code-423n4 / 2023-01-rabbithole-findings

1 stars 2 forks source link

Some smart contracts accounts could not claim their ERC1155Quest reward #657

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/main/contracts/Erc1155Quest.sol#L42

Vulnerability details

Impact

Some accounts are unable to claim their ERC1155 reward, despite having completed the quest. But this is a medium severity, because it concerns only the smart contracts-based accounts (not EOAs) who did not implement the onERC1155Received hook.

Proof of Concept

If msg.sender of the claim function of Quest contract is a smart contract who did not implement a onERC1155Received hook, then his rewards are stuck in the Quest contract.

Recommended Mitigation Steps

Check if onERC1155Received hook is implemented in a participant contract before whitelisting him off-chain, for example by calling supportsInterface(ERC1155HolderID)and checking that the result is true, on the receiving contract.

c4-judge commented 1 year ago

kirk-baird changed the severity to QA (Quality Assurance)

c4-sponsor commented 1 year ago

waynehoover marked the issue as sponsor acknowledged

c4-judge commented 1 year ago

kirk-baird marked the issue as grade-b