RabbitHole receipt, which has its associated rewards already claimed, can still be traded and transferred to others

[code423n4]

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/main/contracts/Quest.sol#L96-L118

Vulnerability details

Impact

After the reward token amount associated with the minted RabbitHole receipt is claimed, the holder of this receipt can still trade and transfer it to another user, who purchases this receipt while being unaware of this receipt's claim status. After the purchase, calling the following claim function for this receipt will revert with the AlreadyClaimed custom error. As a result, this buyer loses the payment amount for purchasing such receipt and is unable to claim any associated rewards.

https://github.com/rabbitholegg/quest-protocol/blob/main/contracts/Quest.sol#L96-L118

    function claim() public virtual onlyQuestActive {
        ...

        uint[] memory tokens = rabbitHoleReceiptContract.getOwnedTokenIdsOfQuest(questId, msg.sender);

        ...

        uint256 redeemableTokenCount = 0;
        for (uint i = 0; i < tokens.length; i++) {
            if (!isClaimed(tokens[i])) {
                redeemableTokenCount++;
            }
        }

        if (redeemableTokenCount == 0) revert AlreadyClaimed();

        ...
    }

Proof of Concept

Please append the following test in the claim() describe block in quest-protocol\test\Erc20Quest.spec.ts. This test will pass to demonstrate the described scenario.

    it.only('RabbitHole receipt, which has its associated rewards already claimed, can still be traded and transferred to others', async () => {
      // firstAddress mints a RabbitHole receipt
      await deployedFactoryContract.connect(firstAddress).mintReceipt(questId, messageHash, signature)
      await deployedQuestContract.start()

      await ethers.provider.send('evm_increaseTime', [86400])

      // firstAddress claims rewards for its RabbitHole receipt
      await deployedQuestContract.connect(firstAddress).claim()

      // firstAddress can still trade and transfer its RabbitHole receipt to secondAddress
      await deployedRabbitholeReceiptContract.connect(firstAddress)['safeTransferFrom(address,address,uint256)'](firstAddress.address, secondAddress.address, 1)

      // However, secondAddress is unable to claim any rewards associated with this RabbitHole receipt
      //   so it loses the payment amount for purchasing this RabbitHole receipt.
      await expect(deployedQuestContract.connect(secondAddress).claim()).to.be.revertedWithCustomError(questContract, 'AlreadyClaimed')

      await ethers.provider.send('evm_increaseTime', [-86400])
    })

Tools Used

VSCode

Recommended Mitigation Steps

When calling the claim function, the RabbitHole receipt, which has its associated rewards claimed, can be burnt so it cannot be traded or transferred afterwards.

[c4-judge]

kirk-baird marked the issue as duplicate of #201

[c4-judge]

kirk-baird changed the severity to 2 (Med Risk)

[c4-judge]

kirk-baird marked the issue as satisfactory