Mystery Box

Summary

Potential gas limit when deleting rewards leaves gaps in the array in functions transferReward, claimAllRewards, claimSingleReward, potentially increasing gas costs over time if the array becomes fragmented.

Vulnerability Details

The use of delete in the rewards array (e.g., delete rewardsOwned[msg.sender][_index]) leaves gaps in the array.

Impact

Deleting rewards within the array (without maintaining its structure) can leave gaps and lead to gas inefficiencies or potential logical issues when managing the rewards. This inefficiency could affect contract performance and increase gas costs for users interacting with the contract. Moreover, in function transferReward if a user transfers rewards multiple times, the gaps in the array will make it more expensive to claim or transfer remaining rewards, potentially frustrating users due to increased transaction fees. So, it causes** **higher gas costs for users and potential logical errors when manipulating arrays, especially as the size of the reward arrays grows.

Tools Used

Manual review.

Recommendations

Instead of deleting elements in the array, replace the item to be deleted with the last item in the array and then pop the last item to maintain a compact array. For example: