Quest System Exploit
- Dominant language
- JavaScript
- Stars
- 1.8k
- Forks
- 776
- PR merge metrics
- No merged PRs in 30d
Description
Hello Gitcoiner!
## Exploit:
**_1) When you submit a wrong response, it's return the next question._**
```js
can_continue: false // wrong response
did_win: false
prize_url: false
question: { // it sends the next question
question: "when Stellar network launched?"
responses: [{answer: "2015"}, {answer: "2016"}]
seconds_to_respond: 15
}
```
**_2) When you fail the quest, you can replay it without waiting._**
The Quest system doesn't check the skimming time and you can replay a frozen quest.
So you can apply a brute force attack to test all the responses and find the path to validate the quest. 3 mins is enough to break a quest.
**_3) Sybil attack with the referral system._**
If you do the exploit 2, you can save all the answers for all quests and apply a sybil attack with a referral link to earn a lot of points.
## Improvement:
- Add a countdown timer for the end of the round.
- Refresh the leaderboard more frequently, maybe a realtime leaderboard.
Contributor guide
Assessment
This issue has not been assessed yet.