Mystery Box

Summary

Both claimAllRewards and claimSingleReward functions involve sending Ether to users before modifying the state (clearing the rewards). This creates a reentrancy vulnerability, where an attacker can repeatedly call the function to drain funds from the contract before the state is updated.

Vulnerability Details

MysteryBox.sol/Line 79 and Line 92

Impact

Attackers could exploit this to withdraw Ether multiple times, draining the contract's funds.

Tools Used

Foundry

Recommendations

• Always update the contract's state before making external calls.

• Consider using ReentrancyGuard from OpenZeppelin to protect against reentrancy attacks.

• Use transfer or send instead of call, which has limited gas to reduce reentrancy risks, although using checks-effects-interactions pattern is still better.