SNARKeling Treasure Hunt
First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low

Centralization Risk: Owner can "Rug" rewards

Author Revealed upon completion

Root + Impact

Description

In a decentralized treasure hunt, funds should ideally be locked and only accessible via valid ZK proofs or after a long timeout.

The current implementation allows the owner to pause() the contract at any time and then call emergencyWithdraw(). This effectively gives the owner a "backdoor" to reclaim all 100 ETH, breaking the trust-minimized nature of the ZK hunt.

// Root cause in codebase
function emergencyWithdraw(address payable recipient, uint256 amount) external {
@> require(paused, "THE_CONTRACT_MUST_BE_PAUSED");
@> require(msg.sender == owner, "ONLY_OWNER_CAN_EMERGENCY_WITHDRAW");
// ...
(bool sent, ) = recipient.call{value: amount}("");
}

Risk

Likelihood: Low

  • Depends on the integrity of the owner.

Impact: High

  • The owner can unilaterally pause the contract and withdraw all funds, including rewards intended for hunters who have already found treasures but not yet claimed them.

Proof of Concept

​

Recommended Mitigation

Implement a time-lock or remove the emergencyWithdraw function in favor of the existing withdraw() function which only works after MAX_TREASURES are claimed.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!