Always increasing gas cost of the getOwnedTokenIdsOfQuest function

[code423n4]

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleReceipt.sol#L106-L135
https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/RabbitHoleReceipt.sol#L95-L104

Vulnerability details

Impact

If the user often participates in quests, buys tokens he accumulates tokens that remain on his account. This leads to huge transactions cost after a while.

Proof of Concept

When user want to claim rewards Quest contract calls getOwnedTokenIdsOfQuest which iterates over all tokens which user has. All iteration cost a gas, so after a while user will have a lot of outdated tokens, but the algorithm still will be iterates over them.

        for (uint i = 0; i < msgSenderBalance; i++) {
            uint tokenId = tokenOfOwnerByIndex(claimingAddress_, i);
            if (keccak256(bytes(questIdForTokenId[tokenId])) == keccak256(bytes(questId_))) {
                tokenIdsForQuest[i] = tokenId;
                foundTokens++;
            }
        }

And this function calls from Quest's claim() transaction, therefore getOwnedTokenIdsOfQuest may use enormous gas amount.

Tools Used

Manual Audit

Recommended Mitigation Steps

In Quest contract when calling claim function, each claimed token must be burned.

[c4-judge]

kirk-baird marked the issue as duplicate of #135

[c4-judge]

kirk-baird changed the severity to 2 (Med Risk)

[c4-judge]

kirk-baird marked the issue as satisfactory