Mystery Box

Summary:

There is nothing preventing an attacker from reentering the contract using the claimAllRewardsfunction causing the attacker to drain funds.

Vulnerability Details:

An adversarial contract can use their recieveor fallbackfunction to reenter the contract in order to drain all of the eth stored.

Impact:

Critical.

Tools Used:

Manual review, Slither.

Recommendations:

Following proper CEI prevents reentrancy by deleting the rewardsOwnedamount before sending out the funds, causing the transaction to revert when trying to reenter.