Mystery Box

Description: Adding a new reward by using MysteryBox::addReward function does not update the reward calculation logic. The logic in MysteryBox::openBox function is pre-determined and does not scale dynamically with the addition if a new reward.

Impact: As one of the core functionalities of the owner/admin is the ability of add new rewards, the contract logic, in its current state, is set up in a way which does not scale in accordance to the new rewards being added.

The highlighted lines in the code snippet of MysteryBox::openBox below show the static logic to calculate the reward based on pre-determined logic.

Proof of Concept:

1. Owner/admin adds a new reward, say, Platinum which is supposed to be the rarest of all, by using MysteryBox::addReward function.

2. User/Player purchases a new mystery box by calling MysteryBox::buyBox.

3. User/Player proceeds to open the box and calls MysteryBox::openBox function. But he will have 0% chance of winning the Platinum reward since the MysteryBox::openBox does not have any logic to dynamically scale with the addition of the Platinum reward in step 1.

Recommended Mitigation: There are a few things to consider in order to get the intended behavior.

1. Create a new array to store weightage of each reward.

2. Update the weightage of the rewards to accomodate the new reward which is added by the owner.

3. in MysteryBox::openBox function, instead of the static logic, have a dynamic logic which can adjust in accordance to the new reward and its weightage.