Summary

Vulnerability Details

https://github.com/Cyfrin/2024-09-mystery-box/blob/main/src/MysteryBox.sol#L79

the claimallreward() function calculate the total reward of a user, then it transfer the users reward to the user address before updating the users reward by deleting the users reward, this is an issue through which a bad user can perform reentrancy attack and drain all fund

Impact

since the claimallreward() function makes the transfer call before updating the users reward, a malicious user could perform a reentrancy attack here and drain all the funds

Tools Used

manual

Recommendations

update the users reward before making the transfer of reward to the user