Mystery Box

Summary

In the claimSingleReward() function, an index check is performed before using _index. However, this check does not adequately prevent "index out of bounds" errors.

Vulnerability Details

The expression require(_index <= rewardsOwned[msg.sender].length, "Invalid index"); checks whether _index is less than or equal to the length of the rewardsOwned[msg.sender] array. However, array indices in Solidity are zero-based, meaning the valid indices for an array of length n range from 0 to n - 1.

Thus, allowing _index to be equal to rewardsOwned[msg.sender].length is incorrect, as it would point to an invalid array position, leading to an "index out of bounds" error when accessing the array.

Impact

1. Reverted Transactions: If _index == rewardsOwned[msg.sender].length, the contract will try to access an invalid array index, causing the transaction to revert with an "index out of bounds" error.

2. User Frustration: Users could encounter frequent transaction failures when they attempt to claim rewards, especially when they provide an index that equals the length of the array, resulting in a poor user experience.

Tools Used

Manual review

Recommendations