Eggstravaganza

First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Severity: high
Invalid

Lack of Duplicate Deposit Check and Event Emission in depositEggToVault() Function

Summary

The function depositEggToVault allows a user to deposit an NFT (Egg) into the vault by calling eggNFT.transferFrom to transfer the NFT from the user to the vault and subsequently calling the depositEgg function on the vault. However, the function does not emit any event to signal that the deposit has taken place. Additionally, it does not prevent the possibility of a user attempting to deposit the same NFT more than once. This could lead to potential issues in tracking the state of deposits and duplicated actions on the same NFT.

Vulnerability Details

The depositEggToVault function allows users to deposit NFTs into the vault but does not emit any events to signal the successful deposit. Additionally, there is no check to prevent the same NFT from being deposited multiple times, which may lead to inconsistent state tracking within the vault.

Here is the vulnerable function:

function depositEggToVault(uint256 tokenId) external {
require(eggNFT.ownerOf(tokenId) == msg.sender, "Not owner of this egg");
// The player must first approve the transfer on the NFT contract.
eggNFT.transferFrom(msg.sender, address(eggVault), tokenId);
eggVault.depositEgg(tokenId, msg.sender);
}

Impact

  • Lack of Event Emission: Users are unable to track successful deposits, leading to a lack of transparency.

  • Duplicate Deposits: Users can deposit the same NFT multiple times, causing incorrect state tracking in the vault and potential security issues..

Tools Used

Manual review

Recommendations

Emit an Event: Add an event to the depositEggToVault function to notify when a successful deposit occurs.

event EggDeposited(address indexed depositor, uint256 tokenId);
require(!storedEggs[tokenId], "Egg already deposited");
Updates

Lead Judging Commences

m3dython Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.