Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Potential Transaction Reversion Due to Dynamic Price Changes

lydiamt

Summary

The owner can change the price of mystery boxes at any time using the setBoxPrice function. This can lead to transaction reversion if the price is altered while a user is attempting to purchase a box with the buyBox function.

Vulnerability Details

The contract includes a setBoxPrice function that enables the owner to update box price.

function setBoxPrice(uint256 _price) public {
require(msg.sender == owner, "Only owner can set price");
boxPrice = _price;
}

The buyBox function requires users to send exactly the current boxPrice in Ether to successfully purchase a mystery box.

function buyBox() public payable {
require(msg.value == boxPrice, "Incorrect ETH sent");
boxesOwned[msg.sender] += 1;
}

If the owner changes the boxPrice while a user is in the process of executing buyBox, the transaction will revert due to the require check for the exact price.

Impact

When the boxPrice changes during a transaction, it can result in the user’s transaction being reverted, causing them to lose gas fees while preventing the purchase of a mystery box. This could lead to user frustration and degrade the overall user experience, potentially discouraging users from participating.

Tools Used

Manual Review

Recommendations

To mitigate issues related to relying on a mutable boxPrice stored in the contract's state, you can pass the price as an argument to the buyBox function.

function buyBox(uint256 expectedPrice) public payable {
require(msg.value == expectedPrice, "Incorrect ETH sent");
require(expectedPrice == boxPrice, "Price mismatch");
boxesOwned[msg.sender] += 1;
}

Passing the expected box price as an argument to the buyBox function enhances user awareness and transaction consistency, helping to mitigate issues related to dynamic price changes.

Updates

Appeal created

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.