Mystery Box

Summary

The claimSingleReward function contains an off-by-one error in its index validation, allowing for potential out-of-bounds access. This issue can lead to unexpected behavior, including DoS for users attempting to claim rewards.

Vulnerability Details

The issue exists in the claimSingleReward function, specifically in the following line:

This condition checks if the provided _index is less than or equal to the length of the rewardsOwned[msg.sender] array. However, since array indices in Solidity are zero-based, using <= allows for the possibility of accessing an index that does not exist. This can lead to an out-of-bounds access, causing the function to revert or behave unexpectedly.

Tools Used

• Manual review

Recommendations

To resolve this issue, the index validation condition in the claimSingleReward function should be modified as follows: