Secure activity rewards against forged sessions and same-day coin farming #9

Problem

Any registered address can call recordActivity() directly with arbitrary score, correct, attempts, and topic. Every call awards DAILY_REWARD_COINS, including repeated calls on the same day. An attacker can submit fabricated perfect sessions repeatedly, reach 100 coins, and drain the CELO reward pool. The contract comment says multiple sessions are allowed, but the README promises “+10 coins every day you play,” not per unverified call.

Impact

• Reward-pool loss and unlimited coin farming.
• Fabricated leaderboard, accuracy, and activity history.
• No meaningful relationship between educational activity and financial rewards.

Proposed scope

• Write and document a threat model for trusted session attestation.
• Enforce the daily base reward at most once per player/day.
• Require authorized, replay-protected session attestations (for example EIP-712 signatures with nonce, deadline, wallet, and result bounds), or redesign rewards so self-reported data has no monetary value.
• Bound score/attempt/topic inputs and define whether multiple legitimate sessions aggregate.
• Add an emergency pause and operational response for the deployed contract; a new deployment/migration will likely be required.

Acceptance criteria

• Repeated same-day activity cannot repeat the daily base reward.
• Forged, expired, replayed, cross-chain, and cross-wallet attestations revert.
• Legitimate multiple sessions have deterministic stats/reward behavior.
• Property/fuzz tests demonstrate coins and CELO claims cannot exceed the documented policy.
• Deployment and migration steps address the already-deployed mainnet instance.