Eggstravaganza

Summary

The depositEggToVault function lacks game state validation checks that are present in other game functions. This critical oversight enables users to deposit NFTs after the game has officially ended, potentially manipulating tournament outcomes, circumventing time-limited promotions, and gaining unfair advantages in competitive scenarios.

Vulnerability Details

In the EggHuntGame contract, the searchForEgg function properly enforces game state,

However, the depositEggToVault function has no such checks:

Attack Scenario: Tournament Manipulation

Consider a tournament scenario where:

1. The game is time-limited (e.g., 1 week)

2. The winner is determined by the number of eggs in the vault at game end

3. Prizes are distributed based on final standings

Attack Flow:

1. Strategic Preparation:

   • Attacker acquires eggs during the game but doesn't deposit them

   • Competitor Alice leads with 10 eggs deposited

   • Attacker has 15 eggs but keeps them in their wallet

2. Game Officially Ends:

   • Admin calls endGame() setting gameActive = false

   • Final standings are announced with Alice in first place

   • Prize distribution preparations begin

3. Post-Game Manipulation:

   • Attacker calls depositEggToVault for all 15 eggs

   • Despite gameActive = false, the deposits succeed

   • Vault now shows attacker with 15 eggs, more than Alice's 10

4. Tournament Disruption:

   • Leaderboard must be recalculated after official end

   • Prize distribution is delayed or contested

   • Tournament integrity is compromised

Impact

Real-World Impact Scenarios

1. Tournament Manipulation:

   • Players can artificially inflate their scores after the game is declared over

   • Winners can be changed after prizes are announced

   • Tournament integrity is compromised

2. Time-Limited Promotions:

   • If rewards are based on deposits during specific time windows, these can be bypassed

3. Economic Exploitation:

   • If the game uses a token-economic model where egg deposits affect token values/rewards

   • Post-game deposits could manipulate these economics after players have made decisions based on game-end state

4. Administrative Confusion:

   • Admin actions based on end-of-game vault state would be invalidated

   • Creates uncertainty around when the "true" game end occurs

This vulnerability has HIGH severity because:

1. Breaks Core Game Mechanics: It fundamentally breaks the time-boxed nature of the game

2. Direct Economic Impact: Could affect prize distributions and token economies

3. Competitive Integrity: Destroys fairness in competitive scenarios

4. Undermines Trust: Players cannot trust official game end declarations

Tools Used

Recommendations

Add proper game state validation to the depositEggToVault function: