Root + Impact

Description

The contract is intended to track unique treasure claims by mapping a bytes32 treasureHash to a boolean. This ensures each reward is only paid out once per unique discovery.

The claim function checks the state of _treasureHash (an uninitialized immutable defaulting to 0x0) instead of the treasureHash provided in the function arguments. Consequently, the check claimed[_treasureHash] will always return false (until someone claims hash 0x0), allowing users to potentially replay proofs for the same treasure or bypass the uniqueness constraint entirely.

Risk

Likelihood: High

• The bug is hard-coded into the primary entry point of the contract.

• Any valid proof submitted will pass this check regardless of whether that specific treasureHash was used before.

Impact: High

• Double Spending: A user can claim the same treasure multiple times until the contract balance is depleted or MAX_TREASURES is reached.

• Loss of Funds: The 100 ETH pool can be drained by a single valid discovery.

Proof of Concept

Recommended Mitigation

Remove the uninitialized immutable variable and validate the actual treasureHash provided by the caller.