Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Static Surprise: Lack of Dynamic Reward Selection in MysteryBox

juggernaut63

Summary

The openBox function in the MysteryBox contract does not utilize the rewardPool for dynamic reward selection. Instead, it relies on hardcoded probabilities, which limits the flexibility and responsiveness of the reward system to changes in the rewardPool.

Vulnerability Details

https://github.com/Cyfrin/2024-09-mystery-box/blob/281a3e35761a171ba134e574473565a1afb56b68/src/MysteryBox.sol#L43-L65

The function determines rewards based on fixed probabilities rather than dynamically selecting from the rewardPool. This approach ignores any changes made to the rewardPool, such as adding or removing rewards, making the reward system static.

function openBox() public {
require(boxesOwned[msg.sender] > 0, "No boxes to open");
​
// Generate a random number between 0 and 99
uint256 randomValue = uint256(keccak256(abi.encodePacked(block.timestamp, msg.sender))) % 100;
​
// Determine the reward based on probability
@=> if (randomValue < 75) {
// 75% chance to get Coal (0-74)
rewardsOwned[msg.sender].push(Reward("Coal", 0 ether));
} else if (randomValue < 95) {
// 20% chance to get Bronze Coin (75-94)
rewardsOwned[msg.sender].push(Reward("Bronze Coin", 0.1 ether));
} else if (randomValue < 99) {
// 4% chance to get Silver Coin (95-98)
rewardsOwned[msg.sender].push(Reward("Silver Coin", 0.5 ether));
} else {
// 1% chance to get Gold Coin (99)
rewardsOwned[msg.sender].push(Reward("Gold Coin", 1 ether));
}
​
boxesOwned[msg.sender] -= 1;
}

The reward determination logic is based on static probabilities rather than dynamically using the rewardPool.

Impact

The system does not adapt to changes in the rewardPool, making it less responsive to updates or modifications.

Tools Used

Manual review

Recommendations

Use the rewardPool to dynamically select rewards based on its current state, allowing for a more flexible and responsive reward system.

Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

addReward won't have any effect on openBox

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!