Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Unrestricted EggHuntGame::searchForEgg Rate Enables Game Economic Exploitation

0xluckyluke

Summary

The EggHuntGame::searchForEgg function lacks rate limiting mechanisms, allowing users to spam search attempts and gain an unfair advantage in egg collection. This, combined with the predictable randomness, creates a significant economic imbalance in the game's reward distribution system.

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-04-eggstravaganza/blob/f83ed7dff700c4319bdfd0dff796f74db5be4538/src/EggHuntGame.sol#L65-L81

The current implementation of EggHuntGame::searchForEgg only checks if the game is active:

function searchForEgg() external {
require(gameActive, "Game not active");
require(block.timestamp >= startTime, "Game not started yet");
require(block.timestamp <= endTime, "Game ended");
​
// Pseudo-random number generation
uint256 random = uint256(
keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))
) % 100;
​
if (random < eggFindThreshold) {
eggCounter++;
eggsFound[msg.sender] += 1;
eggNFT.mintEgg(msg.sender, eggCounter);
emit EggFound(msg.sender, eggCounter, eggsFound[msg.sender]);
}
}

Key issues:

  1. No cooldown period between searches

  2. No daily/hourly limit on search attempts

  3. No cost associated with searching

  4. No increasing difficulty based on user's success

This allows:

  • Transaction spamming within single blocks

  • Bot automation of search attempts

  • Unfair advantage for technically sophisticated users

Impact

  • Economic imbalance in egg distribution

  • Potential network congestion from search spam

  • Unfair advantage for automated players

  • Reduced game enjoyment for legitimate players

  • Devaluation of NFT eggs due to excessive minting

Tools Used

Recommendations

  1. Implement a cooldown mechanism:

contract EggHuntGame is Ownable {
// Minimum time between searches per user
uint256 public constant SEARCH_COOLDOWN = 1 hours;
// Track last search time per user
mapping(address => uint256) public lastSearchTime;
function searchForEgg() external {
require(gameActive, "Game not active");
require(block.timestamp >= startTime, "Game not started yet");
require(block.timestamp <= endTime, "Game ended");
require(
block.timestamp >= lastSearchTime[msg.sender] + SEARCH_COOLDOWN,
"Search cooldown active"
);
// Update last search time before processing
lastSearchTime[msg.sender] = block.timestamp;
// Existing random number generation and egg minting logic
...
}
}

  1. Additional recommendations:

    • Add daily search limits per user

    • Implement increasing difficulty based on user's success

    • Consider adding a small cost per search attempt

    • Add anti-bot measures like CAPTCHA or proof-of-humanity

    • Implement progressive cooldown times that increase with frequent usage

Updates

Lead Judging Commences

m3dython Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

No rate limiting

Contract lacks any cooldown mechanism, search limits, or costs in the searchForEgg() function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!