Submission Details
Severity:
Incomplete Index Validation in MysteryBox::claimSingleReward()
Summary
The index validation in MysteryBox::claimSingleReward() uses <=, which could allow an out-of-bounds error.
Vulnerability Details
Affected Code
require(_index <= rewardsOwned[msg.sender].length, "Invalid index");
Impact
Users can provide an invalid index, potentially causing runtime errors.
Tools Used
Visual Studio Code
Solidity
Foundry
Recommended Mitigation
Correct the condition to < for proper index validation.
require(_index < rewardsOwned[msg.sender].length, "Invalid index");
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.