Eggstravaganza

[M-01] Manual Game Termination Can Lead to Extended Gameplay

Summary

The EggHuntGame contract relies on the contract owner to manually call the endGame() function to deactivate the game, even after the specified endTime has passed. This introduces a discrepancy between the intended end time of the game and its actual deactivation, potentially leading to unintended gameplay behavior.

Vulnerability Details

The startGame() function sets both startTime and endTime, and activates the game via the gameActive boolean flag:

However, once endTime has passed, the game remains active unless the owner explicitly calls:

Because the searchForEgg() function permits egg hunting as long as block.timestamp <= endTime and gameActive == true, the game can continue beyond its expected time window if endGame() is not called promptly.

Impact

• Extended gameplay beyond the intended time if the owner forgets or delays calling endGame().

• Potential for abuse if the owner maliciously allows extended access to egg minting beyond the advertised end time

Tools Used

Manual code review

Recommendations

• Automatically disable the game when endTime is reached within searchForEgg()

• Alternatively, use a modifier like onlyWhileGameActive() that checks both gameActive and the block.timestamp.