Claim function can be lead into DDOS

[code423n4]

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Quest.sol#L99
https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleReceipt.sol#L117-L133

Vulnerability details

Impact

Quest.sol#Claim() can be lead into out of gas error due to unbounded array and user can't unable to claim reward token.

Proof of Concept

User can claim reward token via Receipt NFT contract. After claiming the reward token he still hold claimed mintReceipt and increase his balance. Also user can buy mint Receipt from other marketplace. getOwnedTokenIdsOfQuest() use 2 SLOAD opration and this gas cost is 2100*2 = 4200

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleReceipt.sol#L117-L122

        for (uint i = 0; i < msgSenderBalance; i++) {
            uint tokenId = tokenOfOwnerByIndex(claimingAddress_, i);    // 1st SLOAD (2100 gas)
            if (keccak256(bytes(questIdForTokenId[tokenId])) == keccak256(bytes(questId_))) {       // 2nd SLOAD (2100 gas)
                tokenIdsForQuest[i] = tokenId;
                foundTokens++;
            }
        }

ethereum block gas limit is : 30_00_000

any user can lead into out of gas error after minting ~ 700 ( = 3000000/(2100*2) receipt lead into out of gas error and not able to claim reward token.

this limit is can be easily achievable.

Tools Used

Manual Review

Recommended Mitigation Steps

When user claim reward token Mint Receipt should be burn.

[waynehoover]

Intended use case has ~1-5, not 700+.

[c4-sponsor]

waynehoover marked the issue as sponsor disputed

[c4-judge]

kirk-baird marked the issue as satisfactory

[c4-judge]

kirk-baird marked the issue as duplicate of #552

[kirk-baird]

Although the intended use case is ~5 quests this loop may be reach by numerous participants sending claimed tokens to one user.

It is an unlikely case but I consider this to be a valid medium.