The claimAllRewards
function lets a user claim all of their rewards in one transaction. However, the fundamentals of writing function is Solidity is forgot in this function - The Checks-Effects-Interactions. Forgetting to do so can lead to reentrancy attack in the protocol.
Reentrancy attacks are dangerous to protocols. Because the state is not yet updated. They can end up with drained contracts of funds! Consider the following scenario:
User has bought a box.
Then opened it.
The user continued to claim all his rewards but has a malicious fallback/receive function.
Because the state is not yet update (the mapping element is not yet deleted) there is an attack opening.
His fallback/receive function calls back into claimAllRewards.
The function sends them another payment.
The attacker keeps on until they drain the funds out of the contract.
Manual Review
Follow CEI (Checks-Effects-Interactions) to prevent this attack:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.