Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Reentrancy Attack on claimAllRewards() and claimSingleReward()

lamsy

Summary:

The claimAllRewards() and claimSingleReward() functions are vulnerable to reentrancy attacks due to the transfer of ETH before updating the internal state. Attackers can exploit this flaw to drain the contract's balance by repeatedly calling the claim functions before the state is updated.

Vulnerability Details:

  • The functions transfer ETH to the user before updating the state of rewards, allowing a malicious contract to reenter the function and claim additional rewards.

  • Location: claimAllRewards(), claimSingleReward()

`(bool success,) = payable(msg.sender).call{value: totalValue}("");
require(success, "Transfer failed"); delete rewardsOwned[msg.sender];`

Impact:

  • Fund Drainage: An attacker can use a malicious contract to call the claim function in a loop, draining the contract's ETH balance before the internal state is updated.

  • Denial of Service: Reentrancy can lead to a complete depletion of contract funds, preventing legitimate users from claiming their rewards.

Tools Used:

  • Manual Code Review

  • Remix IDE

Recommendations:

  • Use the checks-effects-interactions pattern by updating the state of the contract before transferring funds. Alternatively, implement a reentrancy guard:

function claimAllRewards() public nonReentrant {
uint256 totalValue = 0;
for (uint256 i = 0; i < rewardsOwned[msg.sender].length; i++) {
totalValue += rewardsOwned[msg.sender][i].value;
}
require(totalValue > 0, "No rewards to claim");
delete rewardsOwned[msg.sender];
(bool success,) = payable(msg.sender).call{value: totalValue}("");
require(success, "Transfer failed");
}
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`claimAllRewards` reentrancy

`claimSingleReward` reentrancy

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.