Mystery Box

Summary :

Analysis:

Checks:
Validation of the index and reward value.
Interactions:
Transfer of Ether to the user.
Effects:
Removal of the reward from the user.

Vulnerability Details & impact:

Similar to the vulnerability found with "claimAllRewards", the interaction (Ether transfer) is performed before the internal state is updated, which may allow a reentrancy attack on this function as well.

Tools Used :

Slither/ Wake et foundry

Recommendations :

Reverse the order to comply with IEC:

function claimSingleReward(uint256 _index) public {
require(_index < rewardsOwned[msg.sender].length, "Invalid index"); // Correction mineure sur la comparaison
uint256 value = rewardsOwned[msg.sender][_index].value;
require(value > 0, "No reward to claim");

}