Mystery Box

Vulnerability Details

The withdrawFunds function enables the contract owner to withdraw the complete balance of the contract. Although the documentation designates the owner as a trusted entity, this functionality presents a considerable risk to users with outstanding or unclaimed rewards. The absence of a mechanism to check for the overall amount of unclaimed rewards means that the owner lacks visibility into when it is appropriate to invoke the withdrawFunds function. As a result, once the owner executes this withdrawal, users may find themselves unable to claim their rewards if the contract balance has been fully depleted.

As a result, users who attempt to claim their rewards afterward will encounter failures or reverts because the contract no longer has sufficient funds to fulfill these claims.

Impact

The potential impact of this vulnerability is substantial. When the trusted owner withdraws funds, users with unclaimed rewards may encounter failed transactions while attempting to claim those rewards. This situation creates a Denial of Service scenario, where legitimate users are left with unclaimed rewards but are unable to access them due to the contract balance being depleted to zero.

Tools Used

Manual Review, VSCode

Recommendations

1. Prioritize User Claims: Modify the withdrawFunds function to check for outstanding overall amount of user rewards before allowing any withdrawals. The contract should not permit withdrawals that would deplete the balance below the total value of unclaimed rewards.

2. Implement Safeguards: Consider implementing a mechanism that requires the owner to specify an amount to withdraw or introduce a cooldown period for withdrawals, ensuring users can claim rewards without being hindered by owner actions.