Possible out of gas error during claiming

[code423n4]

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/Quest.sol#L94-L118
https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleReceipt.sol#L106-L135

Vulnerability details

Impact

User might buy huge amount of tokens and executing claim() function will be cost a lot of gas and it will be too expensive and possible to get out of gas error.
Or even the transaction may not fit in the block.

Proof of Concept

Let's consider function claim and Quest contract.

1. As user we have bought a lot of tokens for example 50_000.
2. Next we decided to claim them.
3. We loads them from rabbitHoleReceiptContract

uint[] memory tokens = rabbitHoleReceiptContract.getOwnedTokenIdsOfQuest(questId, msg.sender);

4. Then we calculates non-claimed tokens

        uint256 redeemableTokenCount = 0;
        for (uint i = 0; i < tokens.length; i++) {
            if (!isClaimed(tokens[i])) {
                redeemableTokenCount++;
            }
        }

In point 3 and point 4 we may iterates over unbounding amount of tokens. Which might lead to out of gas error.

Tools Used

Manual audit

Recommended Mitigation Steps

add threshold parameter to claim function, and to getOwnedTokenIdsOfQuest function.

If processed tokens reach threshold parameter interrupt iteration and process fetched tokens.

[c4-judge]

kirk-baird marked the issue as duplicate of #135

[c4-judge]

kirk-baird marked the issue as satisfactory