usmannk - Issuers may circumvent the expiration timer by closing Ongoing Bounties

[github-actions]

usmannk

high

Issuers may circumvent the expiration timer by closing Ongoing Bounties

Summary

The expiration timer exists to assure claimants of a minimum amount of time they have to complete a task while not having their bounty refunded to a depositor

However, issuers may set an Ongoing Bounty's status to CLOSED even while expiration timers are still running. Doing this after a task has been completed but before it is claimed results in a theft of bounty from the claimant.

Vulnerability Detail

The Ongoing bounty requires that its status is OPEN in order for it to be claimed. Additionally, the closeOngoing() function available to issuers does not respect expiration timers. A malicious issuer may specify large bounties so victims complete their offchain tasks and then set the bounty to CLOSED when the victim's claim transaction appears in the mempool.

The claim transaction will then revert and the victim will not be able to claim their funds.

Ongoing bounties revert during claiming if they are CLOSED.
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/ClaimManager/Implementations/ClaimManagerV1.sol#L456-L464

Issuers may set ongoing bounties to CLOSED at any time.

https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/OpenQ/Implementations/OpenQV1.sol#L328-L351

Impact

Loss of funds to claimants in the amount of the entire claim.

Although this may be "only" classified as "theft of unclaimed yield", I believe it is high severity because claimants must do real off-chain work (like completing a Github Pull Request) before submitting a claim. They are, in effect, being robbed of the work done.

Code Snippet

Tool used

Manual Review

Recommendation

Only allow ongoing bounties to be closed if they have no running expiration timers.

[FlacoJones]

OpenQDev/OpenQ-Contracts#112

[IAm0x52]

Should be low. Issuer is trusted party.

[hrishibhat]

Agree with Lead Watson, considering this issue as low