Submission Details
Severity:
Reentrancy in MysteryBox::claimAllRewards
Summary
CEI is not followed in claimAllRewards so a reentrancy is possible if a user gets a reward that isn't coal.
Vulnerability Details
Reentrancy can be used to drain all funds.
Impact
High
Tools Used
Foundry
Recommendations
delete RewardsOwned[msg.sender]
should be done before:
(bool success,) = payable(msg.sender).call{value: totalValue}("");
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
`claimAllRewards` reentrancy
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.