caventa - [Fund stuck] Fund could stuck if payment schedule number is less than the token address number in Percentage Tier Bounty

[github-actions]

caventa

high

[Fund stuck] Fund could stuck if payment schedule number is less than the token address number in Percentage Tier Bounty

Summary

The fund could stuck if the payment schedule number is less than the token address number in Percentage Tier Bounty

Vulnerability Detail

Let's make an example.

1. Only 1 payout schedule set (Which is 100)
2. 600 MockLink and 600 mockDai is deposited
3. CloseCompetition
4. Claim tiered for MockLink
5. Claim tiered for mockDai (Failed!)

Written a test unit for this in TieredPercentageBounty.test.js

it.only('should transfer volume of tokenAddress balance based on payoutSchedule', async () => {
    await tieredContract.setPayoutSchedule([100]);
    const [, firstPlace] = await ethers.getSigners();
    await tieredContract.connect(depositManager).receiveFunds(owner.address, mockLink.address, 600, Constants.thirtyDays); // 600
    await tieredContract.connect(depositManager).receiveFunds(owner.address, mockDai.address, 600, Constants.thirtyDays); // 600

    await tieredContract.connect(claimManager).closeCompetition();
    await tieredContract.connect(claimManager).claimTiered(firstPlace.address, 0, mockLink.address);
    
    await expect(tieredContract.connect(claimManager).claimTiered(firstPlace.address, 1, mockDai.address)).to.be.revertedWith('0x32'); // unable to claim
    });
})

Impact

As so far the only way to withdraw coin is to claim it, mockDai could be stuck forever

Code Snippet

https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/TieredPercentageBountyV1.sol#L104-L120
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/TieredFixedBountyV1.sol#L91-L107

Tool used

Manual Review

Recommendation

Restrict the number of DISTINCT deposit token addresses should be the same as the payment schedule array length number

[FlacoJones]

Will fix by removing tiered percentage for now

[FlacoJones]

OpenQDev/OpenQ-Contracts#112

[IAm0x52]

Invalid. Test only fails because the second claimTiered uses the wrong tier (1 instead of 0)