Mystery Box

Summary

addRewardfunction allows the contract owner to add a new reward (name and value) to the rewardPool array.

By calling the openBoxfunction, randomValue is generated and then the user gets it`s reward, but only within the initialized by the constructor types of rewards.

Vulnerability Details

Although owneradds a new reward to the protocol, no functionality is provided for it's random picking process by the user, implemented in openBox function.

Tools Used

Manual review

Recommendations

To distribute the newly added rewards from the rewardPool through the openBox function, adjustments need to be the openBox logic so that it selects a reward from the rewardPool array based on randomization, instead of hardcoding specific rewards (like "Coal", "Bronze Coin", etc.).