Mystery Box

Summary

Because the function does not have the onlyOwner modifier or an if statement to check protocol ownership, all users can change protocol ownership and can be protocol's admin/owner.”

In smart contracts, especially those written in Solidity, the onlyOwner modifier is commonly used to restrict access to certain functions so that only the contract owner can execute them12. Without such a modifier or an equivalent access control mechanism, any user can potentially call the function and change the ownership, which can lead to security vulnerabilities.

Vulnerability Details

Through this vulnerability potential attacker can:

• change the mystery box's price,

• withdrawFunds

• addReward

Impact

All users can change protocol ownership and can be protocol's admin/owner.

Tools Used

Foundry

Recommendations

Add the `onlyOwner` modifier, `if` or `require` statment to check ownership.