XKET - Refund after close will cause lack of balance for TieredPercentageBounty

[github-actions]

XKET

medium

Refund after close will cause lack of balance for TieredPercentageBounty

Summary

Depositors can refund their funds after close of a bounty and it will cause lack of balance for TieredPercentageBounty. In this case claimers can't claim their payouts because the balance of bounty is not enough to transfer.

Vulnerability Detail

For tiered percentage bounty, the claimers get payout from the scheduled percent of fundingTotals. (TieredPercentageBountyV1.sol#L115-L118)

        uint256 claimedBalance = (payoutSchedule[_tier] *
            fundingTotals[_tokenAddress]) / 100;

        _transferToken(_tokenAddress, claimedBalance, _payoutAddress);

fundingTotals are locked in closeCompetition.(TieredPercentageBountyV1.sol#L123-L136)

    function closeCompetition() external onlyClaimManager {
        ...
        for (uint256 i = 0; i < getTokenAddresses().length; i++) {
            address _tokenAddress = getTokenAddresses()[i];
            fundingTotals[_tokenAddress] = getTokenBalance(_tokenAddress);
        }
    }

But the DepositManagerV1.refundDeposit checks only expiration and doesn't check if current bounty is opened or closed. So depositors can refund their funds after close and the bounty's balance will be less than fundingTotals which is set when the bounty is closed.
As a result, claimers can't claim their payouts because the bounty doesn't have enough balance to transfer.

Impact

Claimers can't claim their payouts because the bounty doesn't have enough balance to transfer.

Code Snippet

https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/TieredPercentageBountyV1.sol#L115-L118
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/TieredPercentageBountyV1.sol#L123-L136
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/DepositManager/Implementations/DepositManagerV1.sol#L152-L195
https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/BountyCore.sol#L64-L93

Tool used

Manual Review

Recommendation

For TieredPercentageBounty, restrict refund for closed bounties.

Duplicate of #266