Mystery Box

Summary

After oppening one box, malicious user can expand rewards array to arbitrary size by transfering reward back and forth. This happens because delete rewardsOwned[msg.sender][_index]; doesn't delete element in rewards array, nor just reset it and transfered reward is pushed to the rewards array.

Impact

A malicious user can expand the rewards array to an arbitrary size, significantly increasing storage costs

Recommendations

Implement a delete function that shifts elements and uses pop to remove the reward from the array.