Mystery Box

Summary

If the owner only sends 0.1 ether to the contract during the constructor and the first player wins a reward larger than 0.1 ether, the player won’t be able to claim their reward due to insufficient contract balance. Additionally, the owner can't easily add more funds to the contract because there’s no payable function for funding it directly (the owner could repeatedly call buyBox, but that’s not the intended purpose of this function).

Impact

Players may be unable to claim their rewards.

Recommendations

Prevent users from buying a box if there’s a risk that the contract won’t have enough funds to pay the rewards and add funding function. The new condition should be added to the MysteryBox::buyBox function: require((numberOfBoxesInCirculation + 1) * maxReward <= address(this).balance + boxPrice)