ck - _claimTieredFixedBounty claims only one token while supporting multiple NFTs

[github-actions]

ck

medium

_claimTieredFixedBounty claims only one token while supporting multiple NFTs

Summary

_claimTieredFixedBounty claims only one token but supports multiple NFTs

Vulnerability Detail

_claimTieredFixedBounty allows only the claim of one token while maintaining the capability to claim multiple NFTs:

If the intention is to only allow one payout token, then the funding of the bounty should be restricted to that one token.

In addition the support of claiming multiple NFTs conflicts with the setting of a payoutSchedule that supports one _payoutTokenAddress.

    /// @notice Sets the payout schedule
    /// @param _payoutSchedule An array of payout volumes for each tier
    /// @param _payoutTokenAddress The address of the token to be used for the payout
    function setPayoutScheduleFixed(
        uint256[] calldata _payoutSchedule,
        address _payoutTokenAddress
    ) external onlyOpenQ {
        require(
            bountyType == OpenQDefinitions.TIERED_FIXED,
            Errors.NOT_A_FIXED_TIERED_BOUNTY
        );
        payoutSchedule = _payoutSchedule;
        payoutTokenAddress = _payoutTokenAddress;

Impact

Temporary locking of funds.

Code Snippet

https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/Bounty/Implementations/TieredFixedBountyV1.sol#L138-L147

https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/ClaimManager/Implementations/ClaimManagerV1.sol#L278-L341

Tool used

Manual Review

Recommendation

Either allow the claiming of multiple tokens and NFTs or disable support for them for Tiered Fixed Bounties.

[FlacoJones]

Valid. We will likely disable them for TieredFixed for now

[IAm0x52]

Invalid. This is literally just a design decision. Why do they have to be the same number of tokens?

[FlacoJones]

OpenQDev/OpenQ-Contracts#114

[hrishibhat]

Agree with Lead watson's comment.