Mystery Box

Summary

The addReward function allows the owner to add rewards to the rewardPool. However, the rewardPool variable is not used anywhere in the contract, including in the critical openBox function where rewards are distributed. This makes the addition of rewards via addReward ineffective and the rewardPool itself a redundant variable.

Vulnerability Details

The rewardPool is populated with rewards through the addReward function, but it is not referenced when rewards are distributed during the openBox process. Instead of using rewardPool, the openBox function hardcodes the reward probabilities and their values, making any rewards added via addReward irrelevant.

Despite the rewards being added to the rewardPool, they are never considered when determining the rewards that users receive. The openBox function uses hardcoded values for the reward distribution logic, bypassing the rewardPool entirely.

Impact

The addReward function becomes useless because the rewards added through it are never used in the actual reward distribution process. This also makes the rewardPool variable redundant and misleading, potentially confusing developers or auditors who expect it to be part of the reward logic.

Tools Used

• Manual code review

Recommendations

1. Modify the openBox function to pull rewards dynamically from the rewardPool, ensuring that the rewards added via addReward are included in the distribution logic. For example, instead of hardcoding the rewards, you could select rewards randomly from the rewardPool.

2. If you decide to keep the current hardcoded reward system, consider removing the addReward function and the rewardPool variable entirely, as they are currently not serving any functional purpose.

3. Ensure proper documentation and clarity in the contract code to avoid confusion regarding how rewards are handled and distributed.