jkoppel - bountyIsClaimable() returns incorrect result for unidentified bounty types

[github-actions]

jkoppel

false

bountyIsClaimable() returns incorrect result for unidentified bounty types

Summary

ClaimManagerV1.bountyIsClaimable() is supposed to return true for open bounties and false for closed ones. However, for new bounty types that are not one of the known 4, it will do the opposite.

Vulnerability Detail

See Summary.

Impact

This function is never called from another contract, and the else branch will never execute until new contract types are introduced. It could mess up off-chain code in the future.

Code Snippet

From https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/ClaimManager/Implementations/ClaimManagerV1.sol#L345

        if (
            _bountyType == OpenQDefinitions.ATOMIC ||
            _bountyType == OpenQDefinitions.ONGOING ||
            _bountyType == OpenQDefinitions.TIERED_PERCENTAGE ||
            _bountyType == OpenQDefinitions.TIERED_FIXED
        ) {
            return status == 0;
        } else {
            return status == 1;
        }

The else branch should presumably be return false.

Tool used

Manual Review

Recommendation

Removed use of magic numbers. Fix else branch to return false or remove branch entirely.

Duplicate of #386