Submission Details
Severity:
Impractical Strict Price Check in MysteryBox::buyBox()
Summary
The MysteryBox::buyBox() function requires an exact amount of ETH to be sent when purchasing a box, making the transaction strict and possibly inconvenient for users.
Vulnerability Details
Affected Code
require(msg.value == boxPrice, "Incorrect ETH sent");
Impact
Users who overpay will face transaction failures, causing a poor user experience.
Tools Used
Visual Studio Code
Solidity
Foundry
Recommended Mitigation
Allow users to send more ETH and refund any excess.
require(msg.value >= boxPrice, "Insufficient ETH sent");
uint256 refund = msg.value - boxPrice;
if (refund > 0) {
payable(msg.sender).transfer(refund);
}
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.