Eggstravaganza

Summary

The EggHuntGame, EggVault, and EggstravaganzaNFT contracts assign full administrative privileges to a single owner address via the OpenZeppelin Ownable pattern. This centralized authority has the ability to manipulate core gameplay mechanics, control NFT minting permissions, and update critical contract references.

These are common during early development, but such centralization presents significant trust and integrity risks in production environments.

Vulnerability Details

Each of the three core contracts grants elevated privileges to a single owner:

• EggHuntGame.sol

  • EggHuntGame is Ownable - All game controls are gated by onlyOwner

  • `startGame(uint256) - Can start the game arbitrarily

  • endGame() - Can stop the game at any time

  • setEggFindThreshold(uint256) - Can manipulate minting odds

• EggVault.sol

  • EggVault is Ownable - Admin privileges gated by onlyOwner

  • setEggNFT(address) - Can redirect the vault to accept NFTs from an arbitrary or malicious contract

• EggstravaganzaNFT.sol

  • EggstravaganzaNFT is Ownable

  • setGameContract(address) - Can assign minting rights to any contract, including one under attacker control.

Impact

A single privileged account can:

• Unilaterally start, end, or pause the game

• Inflate or suppress minting odds

• Reassign the NFT vault to a malicious contract

• Grant unauthorized contracts minting capabilities

• Undermine fairness of the egg hunt and value of NFTs

This is not a direct exploit, but the level of control extends to core assets and gameplay logic, making it possible to:

• Mint unlimited NFTs

• Deny or enable minting on a whim

• Break trust with players who expect fair gameplay

This violates decentralization expectations and presents a meaningful risk to protocol integrity if abused or compromised.

Tools Used

• Manual code review

• Aderyn

Recommendations

1. Replace Ownable with Role-Based Access Control (RBAC) by using OpenZeppelin's AccessControl to define roles such as GAME_ADMIN, VAULT_ADMIN', or MINTER`.

2. Delegate ownership to a Gnosis Safe (Multisig). This prevents unilateral control by requiring consensus for critical actions.

3. Emitting events for all admin actions ensures game lifecycle events, threshold updates, and NFT assignments are visible to off-chain observers.

4. Document and acknowledge centralization; if central control is temporary, include this in the project README or documentation.

Proof of Concept

Not really an exploit, but the following examples illustrate potential abuses: