Submission Details
Severity:
Mismatch of Reward Values in MysteryBox::openBox()
Summary
The reward values set in the MysteryBox::openBox() function do not match the initial reward values in the rewardPool. This inconsistency could lead to users receiving incorrect rewards.
Vulnerability Details
Affected Code
rewardsOwned[msg.sender].push(Reward("Silver Coin", 0.5 ether)); // vs 0.25 ether in `rewardPool`
rewardsOwned[msg.sender].push(Reward("Gold Coin", 1 ether)); // vs 0.5 ether in `rewardPool`
Impact
Users may receive more or less reward value than expected due to this inconsistency.
Tools Used
Visual Studio Code
Solidity
Foundry
Recommended Mitigation
Ensure that the reward values are consistent across all functions.
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
The rewards in constructor are different from the rewards in openBox
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.