withdrawFee() can be called multiple times by any user when quest has ended making it possible to drain contract and leave users unable to claim rewards
Lines of code Vulnerability details Impact The withdrawFee function in the Erc20Quest contract can be called multiple times. The modifier onlyAdminWithdrawAfterEnd is applied to the function which only makes it possible to call it after the end time of a quest. It should be noted that any user is...