# Protocol fees can be withdrawn multiple times in Erc20Quest

Erc20Quest.withdrawFee lacks a withdrawn-flag and any real access control, so anyone can repeatedly drain quest funds to the fee recipient after endTime.

- Payout: Contest reward
- Severity: high
- Program: RabbitHole
- Credited: adriro
- Disclosed: 2023-04-11
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-rabbithole-findings/issues/605
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-rabbithole%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Erc20Quest / Quest Solidity contracts (withdrawFee, onlyAdminWithdrawAfterEnd modifier)
**Root cause:** withdrawFee transfers protocolFee() each call with no state flag marking fees as withdrawn; the onlyAdminWithdrawAfterEnd modifier only checks block.timestamp >= endTime and enforces no caller restriction.
**Steps:**
1. Deploy quest via factory.createQuest with token, endTime, startTime, totalParticipants, rewardAmountOrTokenId
2. Fund quest with rewards + fees and call quest.start()
3. Warp to endTime
4. As any address, call `quest.withdrawFee()` repeatedly: withdrawCalls = (rewards+fees)/protocolFee()
5. Each call sends protocolFee() tokens to protocolFeeRecipient until contract balance is zero
**How found:** Code review of withdrawFee noticed no idempotency guard, then inspection of the onlyAdminWithdrawAfterEnd modifier revealed it only checks timestamp, not msg.sender, making the drain callable by anyone.
**Exploitation:** Attacker (or griefer) waits until endTime then loops withdrawFee() calls; each transfers protocolFee() to protocolFeeRecipient, draining unclaimed rewards and leftover tokens from the quest contract.
**Insight:** Modifiers named 'onlyAdmin*' may only enforce timing; always verify msg.sender checks separately, and audit any fee/withdraw function for a one-shot state flag since repeatable transfers drain shared balances.