Submission Details
Severity:
Duplicate rewards can be added to the pool
Vulnerability Details
addReward does not check if a reward is aded before and just pushes inside the reward pool array leading to potential duplicate rewards
https://github.com/Cyfrin/2024-09-mystery-box/blob/main/src/MysteryBox.sol#L33-L36
function addReward(string memory _name, uint256 _value) public {
require(msg.sender == owner, "Only owner can add rewards");
rewardPool.push(Reward(_name, _value));
}
Impact
duplicate rewards addition
Tools Used
manual review
Recommendations
Include a check that reward is not added before
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.