RocketDAOProtocolSettingsRewards - settings key collission  Acknowledged
A malicious user may craft a DAO protocol proposal to set a rewards claimer for a specific contract, thus overwriting another contract's settings. This issue arises due to lax requirements when choosing safe settings keys.\\n```\\nfunction setSettingRewardsClaimer(string memory \\_contractName, uint256 \\_perc) override public onlyDAOProtocolProposal {\\n    // Get the total perc set, can't be more than 100\\n    uint256 percTotal = getRewardsClaimersPercTotal();\\n    // If this group already exists, it will update the perc\\n    uint256 percTotalUpdate = percTotal.add(\\_perc).sub(getRewardsClaimerPerc(\\_contractName));\\n    // Can't be more than a total claim amount of 100%\\n    require(percTotalUpdate <= 1 ether, "Claimers cannot total more than 100%");\\n    // Update the total\\n    setUint(keccak256(abi.encodePacked(settingNameSpace,"rewards.claims", "group.totalPerc")), percTotalUpdate);\\n    // Update/Add the claimer amount\\n    setUint(keccak256(abi.encodePacked(settingNameSpace, "rewards.claims", "group.amount", \\_contractName)), \\_perc);\\n    // Set the time it was updated at\\n    setUint(keccak256(abi.encodePacked(settingNameSpace, "rewards.claims", "group.amount.updated.time", \\_contractName)), block.timestamp);\\n}\\n```\\n\\nThe method updates the rewards claimer for a specific contract by writing to the following two setting keys:\\n`settingNameSpace.rewards.claimsgroup.amount<_contractName>`\\n`settingNameSpace.rewards.claimsgroup.amount.updated.time<_contractName>`\\nDue to the way the settings hierarchy was chosen in this case, a malicious proposal might define a `<_contractName> = .updated.time<targetContract>` that overwrites the settings of a different contract with an invalid value.\\nNote that the issue of delimiter consistency is also discussed in issue 5.12.\\nThe severity rating is based on the fact that this should be detectable by DAO members. However, following a defense-in-depth approach means that such collisions should be avoided wherever possible.
We recommend enforcing a unique prefix and delimiter when concatenating user-provided input to setting keys. In this specific case, the settings could be renamed as follows:\\n`settingNameSpace.rewards.claimsgroup.amount.value<_contractName>`\\n`settingNameSpace.rewards.claimsgroup.amount.updated.time<_contractName>`
```\\nfunction setSettingRewardsClaimer(string memory \\_contractName, uint256 \\_perc) override public onlyDAOProtocolProposal {\\n    // Get the total perc set, can't be more than 100\\n    uint256 percTotal = getRewardsClaimersPercTotal();\\n    // If this group already exists, it will update the perc\\n    uint256 percTotalUpdate = percTotal.add(\\_perc).sub(getRewardsClaimerPerc(\\_contractName));\\n    // Can't be more than a total claim amount of 100%\\n    require(percTotalUpdate <= 1 ether, "Claimers cannot total more than 100%");\\n    // Update the total\\n    setUint(keccak256(abi.encodePacked(settingNameSpace,"rewards.claims", "group.totalPerc")), percTotalUpdate);\\n    // Update/Add the claimer amount\\n    setUint(keccak256(abi.encodePacked(settingNameSpace, "rewards.claims", "group.amount", \\_contractName)), \\_perc);\\n    // Set the time it was updated at\\n    setUint(keccak256(abi.encodePacked(settingNameSpace, "rewards.claims", "group.amount.updated.time", \\_contractName)), block.timestamp);\\n}\\n```\\n