Mystery Box

Summary

The contract allows any user to change ownership of the MysteryBox contract. This is due to missing access control on the changeOwner function.

Vulnerability Details

The changeOwner()function is missing access control, allowing any user to gain ownership of the contract, which would then allow them to drain all user funds using the withdrawFunds()function.

Impact

Owner change of contract, ability to drain contract of all user funds.

Tools Used

Manual review, OpenZeppelin.

Recommendations

Apply an onlyOwner modifier to the function. This can be done either by creating the modifier, or preferrably, importing the OpenZeppelin Ownable contract which has the modifier available.