Mystery Box

Summary

The claimSingleReward function in the MysteryBox contract deletes a reward from an array without reordering or compacting the array. This results in gaps within the array, leading to potential inefficiencies and complications in data management.

Vulnerability Details

https://github.com/Cyfrin/2024-09-mystery-box/blob/281a3e35761a171ba134e574473565a1afb56b68/src/MysteryBox.sol#L92-L101

The function uses the delete keyword to remove an element from the rewardsOwned array, which sets the element to its default value but does not reduce the array's length or reorder the remaining elements.

The line delete rewardsOwned[msg.sender][_index]; is where the element is set to its default value, creating a gap in the array.

Impact

Gaps in the array can lead to incorrect assumptions about the data structure, potentially causing errors in logic that processes the array.

Tools Used

Manual review

Recommendations

Instead of using delete, replace the element to be removed with the last element in the array and then reduce the array's length. This approach maintains a contiguous array without gaps.