Submission Details
Severity:
Potential reentrancy attack
Summary
A potential reentrancy attack in (src/MysteryBox.sol#86)
Vulnerability Details
(src/MysteryBox.sol#86)
(bool success,) = payable(msg.sender).call{value: totalValue}("");
require(success, "Transfer failed");
delete rewardsOwned[msg.sender];
Impact
This makes it possible for bad actors to uncover the identity of the mystery boxes by purchasing one ticket, open a box to check for rewards, withdraw them from the contract and repeat the process
Tools Used
Slither
Recommendations
reset the totalValue = zero before `delete rewardsOwned[msg.sender]`
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.