Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Reentrancy Risk in Reward Claim Functions

brene

Summary

The claimAllRewards and claimSingleReward functions are susceptible to reentrancy attacks. This vulnerability arises from the use of external calls to transfer Ether before updating the contract's state, allowing attackers to potentially exploit the contract and claim rewards multiple times.

Vulnerability Details

claimAllRewards and claimSingleReward functions transfer Ether to the caller using the call method before updating the contract's state (i.e., deleting the claimed rewards). This sequence of operations is vulnerable to reentrancy attacks, where an attacker can re-enter the contract and execute the function multiple times before the state is updated.

function claimAllRewards() public {
uint256 totalValue = 0;
for (uint256 i = 0; i < rewardsOwned[msg.sender].length; i++) {
totalValue += rewardsOwned[msg.sender][i].value;
}
require(totalValue > 0, "No rewards to claim");
​
>> (bool success,) = payable(msg.sender).call{value: totalValue}("");
require(success, "Transfer failed");
​
delete rewardsOwned[msg.sender];
}
function claimSingleReward(uint256 _index) public {
require(_index <= rewardsOwned[msg.sender].length, "Invalid index");
uint256 value = rewardsOwned[msg.sender][_index].value;
require(value > 0, "No reward to claim");
​
>> (bool success,) = payable(msg.sender).call{value: value}("");
require(success, "Transfer failed");
​
delete rewardsOwned[msg.sender][_index];
}

An attacker can exploit this by creating a fallback function that calls back into the contract, allowing them to drain funds by repeatedly claiming rewards.

Impact

An attacker could potentially drain the contract's funds by repeatedly exploiting the reentrancy vulnerability, leading to significant financial loss.

Tools Used

Manual Review

Recommendations

Reorder the operations to update the contract's state before making external calls

Updates

Appeal created

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`claimAllRewards` reentrancy

`claimSingleReward` reentrancy

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.