Mystery Box

Summary

A reentrancy attack could drain the contract's asset.

Vulnerability Details

Function claimAllRewards() and claimSingleReward() do not follow Check-Effect-Interaction (CEI) pattern and do not guard against reentrancy attack.
A reentrancy attack may occur by providing a fallback function that re-executes the function call continuously until the contract runs out of assets. The reentrancy attack will be triggered by a low-level call on line 86 and 97.

Impact

The contract loses native assets (Ether).

Tools Used

Manual review.

Recommendations

Consider adding a reentrancy attack mitigation strategy such as OpenZeppelin's reentrancyGuard.