Mystery Box

Summary

The transferReward() function lacks a check to ensure that the recipient address (_to) is not the zero address (0x0000000000000000000000000000000000000000). Without this check, a user could accidentally or maliciously transfer a reward to the zero address, resulting in a permanent loss of the reward.

Vulnerability Details

The function does not validate that the _to address is not the zero address. If the zero address is used as the recipient, the reward will be sent to an address that no one controls, effectively resulting in the loss of the reward.

• Vulnerable Code Snippet

Impact

Transferring a reward to the zero address results in an irreversible loss, as that address is non-recoverable and cannot be accessed by any user. This vulnerability poses a significant risk, as it can lead to the accidental or, in some cases, intentional loss of valuable rewards.

Moreover, all users of the contract face potential consequences from this oversight. If a user inadvertently executes a transfer to the zero address, they could lose rewards that they may have worked hard to earn. This not only diminishes the user experience but also undermines trust in the contract's functionality and security.

Tools Used

Manual review

Recommendations

Consider adding a require statement to check that the _to address is not the zero address before proceeding with the transfer.

As I have shown here: