Mystery Box

Summary

The system does not guarantee that there will be enough assets to cover for user to withdraw their rewards.

Vulnerability Details

The contract collects assets from the following:

• the owner's initial amount transferred during contract deployment

• the amount paid by users when they call buyBox()

There is a possibility that the total amount payable to users are larger than the amount of assets collected by the contract. This can happen if the average boxPrice paid by the users is lower than the average reward that the users get.

If this occurs, then those who are first to withdraw the funds will get the rewards, while the last ones will not receive any reward because there will not be anything left on the contract.

Impact

Users potentially do not receive their reward due to depleted assets held by the contract.

Tools Used

Manual review

Recommendations

Consider adjusting the reward amounts based on the amount of assets held by the contract.