Mystery Box

Summary

The issue with require(_index <= rewardsOwned[msg.sender].length) is that rewardsOwned[msg.sender].length represents the total number of elements in the array, but array indices in Solidity are zero-based. This means the valid range for _index should be from 0 to rewardsOwned[msg.sender].length - 1.

With the current condition <=, is allowed for _index to be equal to rewardsOwned[msg.sender].length, which is out of bounds and would cause an invalid access to the array, leading to a potential runtime error.

Vulnerability Details

If _index is allowed to be equal to rewardsOwned[msg.sender].length, an out-of-bounds access will occur when reading rewardsOwned[msg.sender][_index].value. This can result in unpredictable behavior, including runtime errors or even accessing unintended memory (depending on the Solidity version).

Impact

If an attacker can call claimSingleReward with an out-of-bounds _index, it could cause the contract to revert and potentially block further execution of the function, leading to a Denial-of-Service (DoS).

PoC

Paste the following in the test suite in the setUp()...

... and run the test.

Tools Used

Manual review, Foundry

Recommendations

Update the condition with strict < to check for a valid index within bounds.