Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Access Control on EggVault.depositEgg

martinso

Summary

  • The depositEgg function in EggVault.sol is public and lacks proper access control, allowing anyone to call it and potentially mark an egg as deposited without proper validation or authorization.

Vulnerability Details

  • The function:

function depositEgg(uint256 tokenId, address depositor) public {
require(eggNFT.ownerOf(tokenId) == address(this), "NFT not transferred to vault");
require(!storedEggs[tokenId], "Egg already deposited");
storedEggs[tokenId] = true;
eggDepositors[tokenId] = depositor;
emit EggDeposited(depositor, tokenId);
}

  • It’s intended to be called by EggHuntGame.depositEggToVault after transferring the NFT, but since it’s public, anyone can call it directly.

  • An attacker could call depositEgg after transferring an NFT to the vault themselves, bypassing the game’s logic and potentially locking the NFT in the vault under their control.

Impact

  • An attacker could deposit eggs directly into the vault, bypassing game mechanics, and later withdraw them, potentially stealing or manipulating game assets.

  • This could disrupt the game’s intended flow and lead to unauthorized control over NFTs.

Tools Used

  • Manual code review.

  • Understanding of Solidity access control patterns.

Recommendations

  • Restrict depositEgg to only be callable by the EggHuntGame contract using an access modifier (e.g., onlyGame modifier) or by making it internal and calling it via a controlled function.

  • Example:

address public gameContract;
modifier onlyGame() {
require(msg.sender == gameContract, "Only game contract");
_;
}
function depositEgg(uint256 tokenId, address depositor) public onlyGame { ... }
Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Frontrunning Vulnerability DepositEgg

Front-running depositEgg allows deposit ownership hijacking.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.