Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Reentrancy Vulnerability in claimAllRewards function

ledgerLongBeard

Summary

The claimAllRewards function is vulnerable to reentrancy attacks because it performs an external call to send Ether before updating the user's rewards, allowing attackers to exploit the contract and drain funds.

Vulnerability Details

The function sends Ether to the user before clearing their rewards:

(bool success,) = payable(msg.sender).call{value: totalValue}("");
require(success, "Transfer failed");
delete rewardsOwned[msg.sender];

An attacker could re-enter the function during the external call and claim rewards multiple times.

Impact

  • Fund Drainage: Attackers can repeatedly withdraw funds, potentially emptying the contract's balance.

  • Denial of Service: Legitimate users may be unable to claim rewards due to drained funds.

  • Security Breach: The contract's integrity and user trust are compromised.

Tools Used

  • Manual Code Review: Identifying the sequence of state changes and external calls.

Recommendations

Follow the Checks-Effects-Interactions pattern by updating state variables before making external calls:

function claimAllRewards() public {
uint256 totalValue = 0;
for (uint256 i = 0; i < rewardsOwned[msg.sender].length; i++) {
totalValue += rewardsOwned[msg.sender][i].value;
}
require(totalValue > 0, "No rewards to claim"); // Update state before external call
delete rewardsOwned[msg.sender];
(bool success,) = payable(msg.sender).call{value: totalValue}("");
require(success, "Transfer failed");
}

Additionally, consider using the ReentrancyGuard modifier from OpenZeppelin:

import "@openzeppelin/contracts/security/ReentrancyGuard.sol"; contract MysteryBox is ReentrancyGuard {
// ... function
claimAllRewards() public nonReentrant { // Function code } }
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`claimAllRewards` reentrancy

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!