Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

`MysteryBox` may run out of funds to pay for rewards

poink

Summary

A SEEDVALUE of 0.1 ether is required to be paid to the contract's balance at deployment and the default cost of a box
is also 0.1 ether. This is insufficient, because a silver coin is worth 0.5 ether and a gold coin is worth 1 ether.

Impact

The winner of a silver or gold coin will be unable to claim their rewards unless enough people have purchased a box
or the contract's deployer has paid enough ether to the contract at deployment.

Proof of Concept

  1. Contract is deployed with the minimum SEEDVALUE of 0.1 ether.

  2. User purchases a box for the default amount of 0.1 ether. Contract's total balance: 0.2 ether.

  3. User wins a Gold coin worth 1 ether.

  4. User is unable to claim their prize, because the contract's balance is insufficient.

Test Code:

function testRunOutOfFunds() public {
address user;
uint256 randomValue;
uint256 index;
uint256 boxPrice = mysteryBox.boxPrice();
while(randomValue != 99) {
user = makeAddr(Strings.toString(index));
randomValue = uint256(keccak256(abi.encodePacked(block.timestamp, user))) % 100;
index += 1;
}
vm.deal(user, 1 ether);
vm.startPrank(user);
mysteryBox.buyBox{value: boxPrice}();
mysteryBox.openBox();
MysteryBox.Reward[] memory rewards = mysteryBox.getRewards();
console.log("Reward: ", rewards[0].name,"Value(wei)", rewards[0].value);
console.log("Contract balance: ", address(mysteryBox).balance);
@> vm.expectRevert(bytes("Transfer failed"));
mysteryBox.claimAllRewards();
}

Test Output:

Reward: Gold Coin Value(wei) 1000000000000000000
Contract balance: 200000000000000000

Tools Used

Manual Review, Foundry

Recommendations

Coins could be worth shares of the winning pool instead of a fixed amount, preventing a scenario where the
user is unable to claim their prize.

Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Protocol should have a higher initial balance to prevent prize withdrawing problems

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!