gitcoinco / gitcoinco/web

Quest System Exploit

Open
#6,542 35 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
1.8k
Forks
776
PR merge metrics
No merged PRs in 30d

Description

Hello Gitcoiner!

## Exploit:
**_1) When you submit a wrong response, it's return the next question._**
```js
can_continue: false // wrong response
did_win: false
prize_url: false
question: { // it sends the next question
question: "when Stellar network launched?"
responses: [{answer: "2015"}, {answer: "2016"}]
seconds_to_respond: 15
}
```

**_2) When you fail the quest, you can replay it without waiting._**
The Quest system doesn't check the skimming time and you can replay a frozen quest.
So you can apply a brute force attack to test all the responses and find the path to validate the quest. 3 mins is enough to break a quest.

**_3) Sybil attack with the referral system._**
If you do the exploit 2, you can save all the answers for all quests and apply a sybil attack with a referral link to earn a lot of points.

## Improvement:
- Add a countdown timer for the end of the round.
- Refresh the leaderboard more frequently, maybe a realtime leaderboard.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.