Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Reentrancy

exolorkistis

Summary

There are two instances in the contract where reentrancy is possible and an attacker could be able to take more than he should.

Vulnerability Details

Both claimAllRewards and claimSingleReward functions do not follow the Checks-Effects-Interactions patterns correctly making it possible for a malicious contract to claim more rewards than it should.Since there is no check that the user that buys boxes and claims their rewards is an address and not a contract,a malicious user could use a contract with a fallback function that re-calls the claim functions and since the

delete rewardsOwned[msg.sender];

and the

delete rewardsOwned[msg.sender][_index];
​

are after the call to the contract and not before as they should it is possible for a malicious contract to claim again and again until there is nothing left.

Impact

The impact is very high since this way the contract could be left without any funds by only one malicious user.

Tools Used

Manual

Recommendations

1.Use reentrancy guard.

or

2.Make sure that the Checks-Effects-Interactions patterns are correctly used.

Correct claimAllRewards

function claimAllRewards() public {
uint256 totalValue = 0;
for (uint256 i = 0; i < rewardsOwned[msg.sender].length; i++) {
totalValue += rewardsOwned[msg.sender][i].value;
}
require(totalValue > 0, "No rewards to claim");
delete rewardsOwned[msg.sender];
​
(bool success, ) = payable(msg.sender).call{value: totalValue}("");
require(success, "Transfer failed");
}

correct claimSingleReward

function claimSingleReward(uint256 _index) public {
require(_index <= rewardsOwned[msg.sender].length, "Invalid index");
uint256 value = rewardsOwned[msg.sender][_index].value;
require(value > 0, "No reward to claim");
delete rewardsOwned[msg.sender][_index];
​
(bool success, ) = payable(msg.sender).call{value: value}("");
require(success, "Transfer failed");
​
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`claimAllRewards` reentrancy

`claimSingleReward` reentrancy

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!