Mystery Box

Summary

Both the claimAllRewards and claimSingleReward functions are vulnerable to reentrancy attacks due to the order of operations, where external calls are made before state changes.

Vulnerability Details

In both functions, an external call to transfer funds is made before the corresponding rewards are deleted from the rewardsOwned array. This could allow a malicious user to repeatedly call the function and drain funds from the contract.

Impact

A reentrancy attack could drain the contract of its funds, leading to financial losses and leaving users without the rewards they are owed.

Tools Used

Manual Code Review

Recommendations

Use a "checks-effects-interactions" pattern by first updating the state (e.g., deleting rewards) and then making external calls. Alternatively, consider implementing a reentrancy guard.