Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DOS due to Block.gas limit if the Claimers have many tokens to claim #602

Closed
code423n4 opened this issue Jan 30, 2023 · 3 comments
Closed
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working downgraded by judge Judge downgraded the risk level of this issue duplicate-552 edited-by-warden satisfactory satisfies C4 submission criteria; eligible for awards

Comments

@code423n4
Copy link
Contributor

code423n4 commented Jan 30, 2023

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Quest.sol#L96-L118
https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleReceipt.sol#L106-L135

Vulnerability details

Impact

 If they are many tokens to be claimed by the claim() function this will actually exceed the block.gaslimit and the claimer cannot claim any token. 
 This  is  because the claim function calls the getOwnedTokenIdsOfQuest() function which has two loops going on it, the claim() function checks in a 
 loop whether the tokens are claimed and also it calls the _setClaimed() function which consists of a loop.

Proof of Concept

  Suppose they are 50 tokens to be claimed by the claimer now the function will surely revert due to block.gaslimit and as mentioned above why will 
  it happens.

Tools Used

 Pen and Paper

Recommended Mitigation Steps

 It is always recommended to have a maximum claiming of rewards per transaction instead of claiming all the tokens at a time. For example, it is 
 better to claim rewards for 10 tokens at a time if the claimer has 50 tokens so that the person can call the function 5 times and claim all the tokens.
@code423n4 code423n4 added 3 (High Risk) Assets can be stolen/lost/compromised directly bug Something isn't working labels Jan 30, 2023
code423n4 added a commit that referenced this issue Jan 30, 2023
@code423n4 code423n4 changed the title Block.gas limit if the Claimers have many tokens to claim DOS due to Block.gas limit if the Claimers have many tokens to claim Jan 30, 2023
@c4-judge c4-judge closed this as completed Feb 6, 2023
@c4-judge
Copy link
Contributor

c4-judge commented Feb 6, 2023

kirk-baird marked the issue as duplicate of #135

@c4-judge
Copy link
Contributor

kirk-baird changed the severity to 2 (Med Risk)

@c4-judge c4-judge added 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value downgraded by judge Judge downgraded the risk level of this issue and removed 3 (High Risk) Assets can be stolen/lost/compromised directly labels Feb 14, 2023
@c4-judge
Copy link
Contributor

kirk-baird marked the issue as satisfactory

@c4-judge c4-judge added satisfactory satisfies C4 submission criteria; eligible for awards duplicate-552 and removed duplicate-135 labels Feb 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working downgraded by judge Judge downgraded the risk level of this issue duplicate-552 edited-by-warden satisfactory satisfies C4 submission criteria; eligible for awards
Projects
None yet
Development

No branches or pull requests

2 participants