HonorLt - Malicious token can block tiered percentage bounty close

[github-actions]

HonorLt

high

Malicious token can block tiered percentage bounty close

Summary

It might be impossible to close the tiered percentage bounty if any token balance calculation fails.

Vulnerability Detail

When closing the tiered percentage bounty competition it iterates over all the tokens and gets their respective balances:

    function closeCompetition() external onlyClaimManager {
        require(
            status == OpenQDefinitions.OPEN,
            Errors.CONTRACT_ALREADY_CLOSED
        );

        status = OpenQDefinitions.CLOSED;
        bountyClosedTime = block.timestamp;

        for (uint256 i = 0; i < getTokenAddresses().length; i++) {
            address _tokenAddress = getTokenAddresses()[i];
            fundingTotals[_tokenAddress] = getTokenBalance(_tokenAddress);
        }
    }

The problem is that token.balanceOf might revert if a malicious token was inserted among other funds. This is highly possible because any token can be used unless the limit is reached:

    function fundBountyToken(
        address _bountyAddress,
        address _tokenAddress,
        uint256 _volume,
        uint256 _expiration,
        string memory funderUuid
    ) external payable onlyProxy {
        IBounty bounty = IBounty(payable(_bountyAddress));

        if (!isWhitelisted(_tokenAddress)) {
            require(
                !tokenAddressLimitReached(_bountyAddress),
                Errors.TOO_MANY_TOKEN_ADDRESSES
            );
        }

Impact

If a malicious token that reverts on a certain balanceOf call, is inserted in the tiered percentage bounty funds, it will be impossible to close this bounty.

Code Snippet

https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/TieredPercentageBountyV1.sol#L132-L135

Tool used

Manual Review

Recommendation

There are many possibilities. For example, you can try/catch and set the balance to 0 if it reverts, or get the balance only when claiming and allow specifying which tokens to claim.

Duplicate of #62