Secure activity rewards against forged sessions and same-day coin farming

[llinsss]

Problem

Any registered address can call recordActivity() directly with arbitrary score, correct, attempts, and topic. Every call awards DAILY_REWARD_COINS, including repeated calls on the same day. An attacker can submit fabricated perfect sessions repeatedly, reach 100 coins, and drain the CELO reward pool. The contract comment says multiple sessions are allowed, but the README promises “+10 coins every day you play,” not per unverified call.

Impact

• Reward-pool loss and unlimited coin farming.
• Fabricated leaderboard, accuracy, and activity history.
• No meaningful relationship between educational activity and financial rewards.

Proposed scope

• Write and document a threat model for trusted session attestation.
• Enforce the daily base reward at most once per player/day.
• Require authorized, replay-protected session attestations (for example EIP-712 signatures with nonce, deadline, wallet, and result bounds), or redesign rewards so self-reported data has no monetary value.
• Bound score/attempt/topic inputs and define whether multiple legitimate sessions aggregate.
• Add an emergency pause and operational response for the deployed contract; a new deployment/migration will likely be required.

Acceptance criteria

• Repeated same-day activity cannot repeat the daily base reward.
• Forged, expired, replayed, cross-chain, and cross-wallet attestations revert.
• Legitimate multiple sessions have deterministic stats/reward behavior.
• Property/fuzz tests demonstrate coins and CELO claims cannot exceed the documented policy.
• Deployment and migration steps address the already-deployed mainnet instance.

[Chidi-Dev1]

I have a clear understanding of the issue and would appreciate being assigned to work on it.

[gloskull]

Hi, I’d love to work on this issue.
I have 4 years of experience across backend, frontend, full-stack, and smart contract development. I understand the task clearly and can deliver a clean, efficient, well-tested solution on time, with strong focus on code quality and maintainability.
My PR will be submitted in 4days

[caramel222]

hi, can i work on this?

[Xaxxoo]

Hi, can I please take up on this issue ?

[grantfox-oss]

🦊 GrantFox — @Xaxxoo has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #9)
2. Your PR will be reviewed by the DogStark maintainers

Good luck! Track your progress on GrantFox.