SNARKeling Treasure Hunt

First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View results
Submission Details
Severity: medium
Valid

Deployment Script Can Permanently Lock ETH via Incorrect Initial Funding Assumptions

Root + Impact

Description

  • The deployment script funds TreasureHunt with ETH so rewards can be paid out to valid ZK proof claimants.

The script blindly trusts an environment variable for funding and performs no sanity checks relative to REWARD * MAX_TREASURES, allowing underfunded or misfunded deployments that permanently break reward distribution.

//@> No validation that initialFunding >= REWARD * MAX_TREASURES
uint256 initialFunding = vm.envOr("INITIAL_FUNDING", DEFAULT_INITIAL_FUNDING);
hunt = new TreasureHunt{value: initialFunding}(address(verifier));
require(hunt.getContractBalance() == initialFunding, "UNEXPECTED_BALANCE");

Risk

Likelihood:

  • Occurs whenever deployment is done with a misconfigured .env file or reused deployment scripts across networks

Occurs during rushed contest / hackathon / production deployments

Impact:

  • Rewards become unclaimable for later users

ETH becomes permanently stuck with no withdrawal mechanism

Proof of Concept

INITIAL_FUNDING = 10 ether
REWARD = 10 ether
MAX_TREASURES = 10
→ Only first treasure can be paid
→ Remaining 9 valid proofs revert forever

Recommended Mitigation

- remove this code
+ add this code
+uint256 requiredFunding = hunt.REWARD() * hunt.MAX_TREASURES();
+require(initialFunding >= requiredFunding, "INSUFFICIENT_INITIAL_FUNDING");
Updates

Lead Judging Commences

s3mvl4d Lead Judge 18 days ago
Submission Judgement Published
Validated
Assigned finding tags:

liquidity enforcement issues

The liquidity-enforcement issue arises because the protocol assumes the hunt will be funded with enough ETH to cover all rewards, but the contract itself does not actively enforce that invariant at deployment time. The constructor accepts arbitrary `msg.value` and only validates the verifier address, even though the contract hardcodes a reward of 10 ether and a maximum of 10 treasures, implying an expected full funding target of 100 ether; the README likewise states that the contract is expected to be funded with enough ETH to cover all rewards and notes that the default deployment flow uses 100 ether. Although the deployment script sets `DEFAULT_INITIAL_FUNDING = 100 ether`, it also allows that amount to be overridden via `vm.envOr("INITIAL_FUNDING", DEFAULT_INITIAL_FUNDING)`, and the only post-deployment balance check is that the contract balance equals the chosen `initialFunding`, not that the chosen amount is actually sufficient to fund the full hunt. As a result, the system can be deployed in an underfunded state after which otherwise valid claims will begin reverting with `NotEnoughFunds()` once the balance drops below a single reward payment.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!