Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Front-running attack in function `buyBox`

safdie

Summary

Front-running attack in function buyBox, leading to a concentration of boxes with certain players and potentially unbalancing the system.

Vulnerability Details

The function boxPrice can be adjusted by the owner, and if a user sends a transaction to buyBox while the owner increases the price, the transaction may fail due to the require(msg.value == boxPrice) check. This could potentially be exploited by front-runners.

Impact

The randomness or value associated with boxes can be affected if front-runners consistently outbid other legitimate users, leading to a concentration of boxes with certain players and potentially unbalancing the system.

Tools Used

Manual review.

Recommendations

Consider allowing users to specify the price they are willing to pay to avoid race conditions:

function buyBox() public payable {
require(msg.value == boxPrice, "Incorrect ETH sent");
boxesOwned[msg.sender] += 1;
}
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!