withdrawFee() can be called multiple times by any user when quest has ended making it possible to drain contract and leave users unable to claim rewards

Lines of code Vulnerability details Impact The withdrawFee function in the Erc20Quest contract can be called multiple times. The modifier onlyAdminWithdrawAfterEnd is applied to the function which only makes it possible to call it after the end time of a quest. It should be noted that any user is...

protocolFeeRecipient might take unclaimed reward token after quest ends.

Lines of code Vulnerability details Impact Since there is no code to check whether fee has been drawn, withdrawFee might be called multiple times. This allows protocolFeeRecipient to steal all of the unclaimed reward tokens after quest ended. Proof of Concept Provide direct links to all reference...