Submission Details
Severity:
MysteryBox::withdrawFunds() Function Withdraws All ETH Including User Rewards
Summary
The MysteryBox::withdrawFunds() function allows the owner to withdraw all ETH from the contract, including funds meant for user rewards.
Vulnerability Details
Affected Code
(bool success,) = payable(owner).call{value: address(this).balance}("");
Impact
Users may not be able to claim their rewards if the owner withdraws all ETH, leaving the contract balance at zero.
Tools Used
Visual Studio Code
Solidity
Foundry
Recommended Mitigation
Track profits separately from funds meant for rewards, and only allow the owner to withdraw the profits.
uint256 ownerBalance = address(this).balance - totalRewards;
(bool success,) = payable(owner).call{value: ownerBalance}("");
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.