Mystery Box

Summary

The withdrawFunds function allows the contract owner to withdraw all funds in the contract. While this is expected, if the contract owner is compromised or malicious, they could drain all funds from the contract at any time.

Vulnerability Details

MysteryBox.sol/Line 67

Impact

If the owner’s private key is compromised or the owner becomes malicious, all funds could be stolen without recourse for users.

Tools Used

Foundry

Recommendations

Consider implementing a time lock or a multi-signature wallet for owner functions, including fund withdrawals, to increase security and reduce the risk of fund misappropriation.