The deployment script funds TreasureHunt with ETH so rewards can be paid out to valid ZK proof claimants.
The script blindly trusts an environment variable for funding and performs no sanity checks relative to REWARD * MAX_TREASURES, allowing underfunded or misfunded deployments that permanently break reward distribution.
Likelihood:
Occurs whenever deployment is done with a misconfigured .env file or reused deployment scripts across networks
Occurs during rushed contest / hackathon / production deployments
Impact:
Rewards become unclaimable for later users
ETH becomes permanently stuck with no withdrawal mechanism
The liquidity-enforcement issue arises because the protocol assumes the hunt will be funded with enough ETH to cover all rewards, but the contract itself does not actively enforce that invariant at deployment time. The constructor accepts arbitrary `msg.value` and only validates the verifier address, even though the contract hardcodes a reward of 10 ether and a maximum of 10 treasures, implying an expected full funding target of 100 ether; the README likewise states that the contract is expected to be funded with enough ETH to cover all rewards and notes that the default deployment flow uses 100 ether. Although the deployment script sets `DEFAULT_INITIAL_FUNDING = 100 ether`, it also allows that amount to be overridden via `vm.envOr("INITIAL_FUNDING", DEFAULT_INITIAL_FUNDING)`, and the only post-deployment balance check is that the contract balance equals the chosen `initialFunding`, not that the chosen amount is actually sufficient to fund the full hunt. As a result, the system can be deployed in an underfunded state after which otherwise valid claims will begin reverting with `NotEnoughFunds()` once the balance drops below a single reward payment.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.