Mystery Box

Description:
The function MysteryBox#changeOwner() allows anyone to become the contract owner by simply calling the function. This creates a severe vulnerability where an attacker can take control of the contract, leading to catastrophic consequences.

1. Once an attacker gains ownership, they can call MysteryBox#withdrawFunds() and drain all the money from the reward pool.

2. They can set the box price to zero using MysteryBox#setBoxPrice(), allowing them to buy all boxes for free.

3. The attacker can control all contract functions, steal rewards, and siphon the contract’s entire balance.

Impact:
If an attacker becomes the contract owner, they can:

• Drain the entire contract balance.

• Manipulate box prices.

• Steal users' rewards.

• Essentially take full control of the contract, causing significant financial damage to all users.

Proof of Concept:
An attacker calls MysteryBox#changeOwner() and passes their own address as the new owner:

Now, the attacker can withdraw all funds or set malicious box prices.

Recommendation:
Restrict ownership changes by ensuring only the current owner can call the changeOwner() function:

This will prevent unauthorized users from changing the contract ownership.