Summary

If the first user of the protocol wins a reward that's worth more than 0.1 ETH, then she may not able to claim her reward instantly as the protocol may be insolvent at that early stage.

Vulnerability Details

the time a user claims her reward is directly proportional to the revenue generated by the protocol hence the claimAllRewards function is not available readily to buyers of boxes

Impact

• poor UX

• protocol may become insolvent if enough user didn't buy boxes

Tools Used

• manual review

Recommendations

there should be time set for claiming of rewards and the timing should be set to a future date