Mystery Box

Description:

The owner can successfully add rewards by calling addReward, but even though this new reward will be added to the rewardPool this does not update the probabilities associated with each reward as described in MysteryBox::openBox.

Impact:

While the owner can add new rewards to rewardPool, these newly created rewards will not be winnable by users.

Proof of Concept:

1. owner adds a new reward addReward("Diamond Coin", 2 ether);.

2. this reward is added to the list of rewards rewardPool.push(Reward(_name, _value));

3. still, without openBox being updated to reflect the new reward, the user still has a 75% chance of coal, 20% bronze, 4% silver, and 1% gold (and 0% diamond).

Recommended Mitigation:

One solution could be to expand the Reward struct to include the probablities of each reward, and then to add a function to allow for the removal or editing of existing.