cccz - Unable to claim NFT in OngoingBounty

[github-actions]

cccz

medium

Unable to claim NFT in OngoingBounty

Summary

ClaimManagerV1._claimOngoingBounty could not claim NFT in OngoingBounty.

Vulnerability Detail

OngoingBountyV1.receiveNft allows users to deposit NFT into OngoingBounty.

    function receiveNft(
        address _sender,
        address _tokenAddress,
        uint256 _tokenId,
        uint256 _expiration,
        bytes calldata
    ) external onlyDepositManager nonReentrant returns (bytes32) {
        require(
            nftDeposits.length < nftDepositLimit,
            Errors.NFT_DEPOSIT_LIMIT_REACHED
        );
        require(_expiration > 0, Errors.EXPIRATION_NOT_GREATER_THAN_ZERO);
        _receiveNft(_tokenAddress, _sender, _tokenId);

but ClaimManagerV1._claimOngoingBounty cannot claim the NFT in OngoingBounty

    function _claimOngoingBounty(
        IOngoingBounty _bounty,
        address _closer,
        bytes calldata _closerData
    ) internal {
        _eligibleToClaimOngoingBounty(_bounty, _closer, _closerData);

        (address tokenAddress, uint256 volume) = _bounty.claimOngoingPayout(
            _closer,
            _closerData
        );

Unlike this, the other three types of bounty all allow the winner to claim NFT

Impact

The winner cannot claim the NFT deposited by other users

Code Snippet

https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/OngoingBountyV1.sol#L133-L146
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/ClaimManager/Implementations/ClaimManagerV1.sol#L173-L197

Tool used

Manual Review

Recommendation

Consider specifying the claimant when depositing NFTs in the Ongoing Bounty and allowing the user corresponding to that claimant to claim the NFTs

Duplicate of #261