When quest is paused, RabbitHole receipt can still be traded and transferred to others

[code423n4]

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/main/contracts/Quest.sol#L96-L118

Vulnerability details

Impact

When the quest is paused, the minted RabbitHole receipt can still be traded and transferred from its holder to another user. If a user wants to exchange some tokens to the reward tokens of the quest, and the price for purchasing the receipt is better than the rates offered by other exchanges, she or he would purchase the receipt from the holder. However, since the quest is paused at that moment, calling the following claim function for this purchased receipt will revert with the QuestPaused custom error. Although the quest can be unpaused later, the buyer fails to receive the associated reward tokens immediately and cannot fulfill the goal for exchanging tokens in a timely manner. Also, when the quest becomes unpaused, the exchange rate offered by the quest can become worse than these offered by other exchanges at that moment.

https://github.com/rabbitholegg/quest-protocol/blob/main/contracts/Quest.sol#L96-L118

    function claim() public virtual onlyQuestActive {
        if (isPaused) revert QuestPaused();

        ...
    }

Proof of Concept

Please append the following test in the claim() describe block in quest-protocol\test\Erc20Quest.spec.ts. This test will pass to demonstrate the described scenario.

    it.only('RabbitHole receipt can still be traded and transferred to others when quest is paused', async () => {
      // firstAddress mints a RabbitHole receipt
      await deployedFactoryContract.connect(firstAddress).mintReceipt(questId, messageHash, signature)
      await deployedQuestContract.start()

      await ethers.provider.send('evm_increaseTime', [10000])

      // quest becomes paused
      await deployedQuestContract.pause()

      // firstAddress can still trade and transfer its RabbitHole receipt to secondAddress
      await deployedRabbitholeReceiptContract.connect(firstAddress)['safeTransferFrom(address,address,uint256)'](firstAddress.address, secondAddress.address, 1)

      // yet, secondAddress is unable to claim any rewards associated with this RabbitHole receipt immediately
      await expect(deployedQuestContract.connect(secondAddress).claim()).to.be.revertedWithCustomError(questContract, 'QuestPaused')

      await ethers.provider.send('evm_increaseTime', [-10000])
    })

Tools Used

VSCode

Recommended Mitigation Steps

When the quest is paused, the transfer functionality of the minted RabbitHole receipts can be paused as well.

[c4-judge]

kirk-baird changed the severity to QA (Quality Assurance)

[c4-sponsor]

waynehoover marked the issue as sponsor acknowledged

[c4-judge]

kirk-baird marked the issue as grade-a

[c4-judge]

kirk-baird marked the issue as grade-b

[c4-judge]

kirk-baird marked the issue as grade-a