Submission Details
Severity:
`MysteryBox.sol::ClaimSingleReward` with wrong validation check
Relevant GitHub Links
https://github.com/Cyfrin/2024-09-mystery-box/blob/main/src/MysteryBox.sol#L93
Summary
There is a wrong validation check in the function called `MysteryBox.sol::ClaimSingleReward` which will lead to a panic error
Vulnerability Details
In the `require` condition the `_index` of the `MysteryBox.sol::ClaimSingleReward` function should be `<` and not `=` to `rewardsOwned[msg.sender].length`
function claimSingleReward(uint256 _index) public {
require(_index <= rewardsOwned[msg.sender].length, "Invalid index");
Impact
The user will get a panic error from the compiler using the function called `MysteryBox.sol::ClaimSingleReward`
function test_indexclaimSingleReward() public {
vm.deal(user1, 1 ether);
vm.startPrank(user1);
mysteryBox.buyBox{value: 0.1 ether}();
mysteryBox.buyBox{value: 0.1 ether}();
mysteryBox.buyBox{value: 0.1 ether}();
mysteryBox.buyBox{value: 0.1 ether}();
console.log("Before Open:", mysteryBox.boxesOwned(user1));
mysteryBox.openBox();
mysteryBox.openBox();
mysteryBox.openBox();
mysteryBox.openBox();
mysteryBox.claimSingleReward(4);
}
[FAIL. Reason: panic: array out-of-bounds access (0x32)] test_indexclaimSingleReward() (gas: 200512)
Logs:
Reward Pool Length: 4
Before Open: 4
Traces:
[1415734] MysteryBoxTest::setUp()
├─ [0] VM::addr(<pk>) [staticcall]
│ └─ ← [Return] owner: [0x7c8999dC9a822c1f0Df42023113EDB4FDd543266]
├─ [0] VM::label(owner: [0x7c8999dC9a822c1f0Df42023113EDB4FDd543266], "owner")
│ └─ ← [Return]
├─ [0] VM::deal(owner: [0x7c8999dC9a822c1f0Df42023113EDB4FDd543266], 1000000000000000000 [1e18])
│ └─ ← [Return]
├─ [0] VM::prank(owner: [0x7c8999dC9a822c1f0Df42023113EDB4FDd543266])
│ └─ ← [Return]
├─ [1292005] → new MysteryBox@0x88F59F8826af5e695B13cA934d6c7999875A9EeA
│ └─ ← [Return] 5323 bytes of code
├─ [6372] MysteryBox::getRewardPool() [staticcall]
│ └─ ← [Return] [Reward({ name: "Gold Coin", value: 500000000000000000 [5e17] }), Reward({ name: "Silver Coin", value: 250000000000000000 [2.5e17] }), Reward({ name: "Bronze Coin", value: 100000000000000000 [1e17] }), Reward({ name: "Coal", value: 0 })]
├─ [0] console::log("Reward Pool Length:", 4) [staticcall]
│ └─ ← [Stop]
└─ ← [Stop]
[180612] MysteryBoxTest::test_indexclaimSingleReward()
├─ [0] VM::deal(0x0000000000000000000000000000000000000001, 1000000000000000000 [1e18])
│ └─ ← [Return]
├─ [0] VM::startPrank(0x0000000000000000000000000000000000000001)
│ └─ ← [Return]
├─ [24580] MysteryBox::buyBox{value: 100000000000000000}()
│ └─ ← [Stop]
├─ [680] MysteryBox::buyBox{value: 100000000000000000}()
│ └─ ← [Stop]
├─ [680] MysteryBox::buyBox{value: 100000000000000000}()
│ └─ ← [Stop]
├─ [680] MysteryBox::buyBox{value: 100000000000000000}()
│ └─ ← [Stop]
├─ [608] MysteryBox::boxesOwned(0x0000000000000000000000000000000000000001) [staticcall]
│ └─ ← [Return] 4
├─ [0] console::log("Before Open:", 4) [staticcall]
│ └─ ← [Stop]
├─ [48132] MysteryBox::openBox()
│ └─ ← [Stop]
├─ [26232] MysteryBox::openBox()
│ └─ ← [Stop]
├─ [26232] MysteryBox::openBox()
│ └─ ← [Stop]
├─ [26232] MysteryBox::openBox()
│ └─ ← [Stop]
├─ [716] MysteryBox::claimSingleReward(4)
│ └─ ← [Revert] panic: array out-of-bounds access (0x32)
└─ ← [Revert] panic: array out-of-bounds access (0x32)
Suite result: FAILED. 0 passed; 1 failed; 0 skipped; finished in 2.66ms (990.31µs CPU time)
Ran 1 test suite in 800.72ms (2.66ms CPU time): 0 tests passed, 1 failed, 0 skipped (1 total tests)
Failing tests:
Encountered 1 failing test in test/TestMysteryBox.t.sol:MysteryBoxTest
[FAIL. Reason: panic: array out-of-bounds access (0x32)] test_indexclaimSingleReward() (gas: 200512)
Tools Used
Manual review, Foundry
Recommendations
function claimSingleReward(uint256 _index) public {
- require(_index <= rewardsOwned[msg.sender].length, "Invalid index");
+ require(_index < rewardsOwned[msg.sender].length, "Invalid index");
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.