Submission Details
Severity:
Users can get as many HealthTokens as they want by presenting to themselves
Summary
HealthToken scarcity destroyed through gifting
Vulnerability Details
By having multiple burner wallets that one controls, and then invoking makePresent() on each of them, user can collect as many HealthTokens as possible by invoking collectReward() with the address that holds the ERC721 tokens at the moment.
Impact
HealthToken scarcity will be compromised, if they're supposed to be valuable.
Tools Used
Manual review
Recommendations
Have a different way to track reward eligibility, instead of token balance, since token balance is dynamic and users can use the same tokens to get rewards by using burner wallets.
Updates
Lead Judging Commences
bube over 1 year ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
Multiple addresses
Rewards breakdown
nSLOC
239This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.