Eggstravaganza

Summary

This report identifies critical vulnerabilities in the EggHunt game ecosystem, including insecure pseudo-random number generation, insufficient access control, and reentrancy risks. The system’s current implementation exposes users to potential exploitation, such as unfair NFT minting and unauthorized vault operations.

Vulnerability Details

1. Insecure Pseudo-Random Number Generation

Location: EggHuntGame.sol → searchForEgg()

Description:

The searchForEgg() function generates pseudo-randomness using block.timestamp and block.prevrandao, which are predictable values. Attackers can precompute favorable conditions to guarantee successful egg minting.

Attack Scenario:

• A malicious contract calls searchForEgg() multiple times in a single transaction, exploiting the same block variables to manipulate outcomes.

• Expected success rate becomes significantly higher than the defined eggFindThreshold (e.g., 20%).

payload

2. Missing Access Control in Vault Operations

Location: EggVault.sol → depositEgg()

Description:

The depositEgg() function lacks validation to ensure only the game contract can trigger it. Any address can spoof deposits, allowing fake NFTs to be stored in the vault.

Attack Scenario:

• An attacker deploys a malicious contract to call depositEgg() with arbitrary token IDs, corrupting vault records.

payload

3. Reentrancy Risk in Vault Withdrawals (Medium)

Location: EggVault.sol → withdrawEgg()

Description:

Although the function follows checks-effects-interactions, the lack of reentrancy guards exposes it to risks if external dependencies are modified.

Impact

Tools Used

• Manual Code Review

• Foundry

Recommendations

Critical Fixes

1. Replace Insecure RNG:

   • Use Chainlink VRF for verifiable randomness.

   • Short-term workaround: Implement a commit-reveal scheme.

   // Commit-Reveal Example

   function commitSearch(bytes32 hash) external {

   commits[msg.sender] = hash;

   }

   function revealSearch(uint salt) external {

   require(keccak256(abi.encodePacked(salt)) == commits[msg.sender]);

   uint random = uint(keccak256(abi.encodePacked(salt, blockhash(block.number - 1)))) % 100;

   }

   ​

   ​

2. Enforce Access Control:

   • Restrict depositEgg() to the game contract.

   modifier onlyGameContract() {

   require(msg.sender == address(eggHuntGame), "Unauthorized");

   _;

   }

   ​

   ​

High-Priority Fixes

1. Validate NFT Approvals:

   function depositEggToVault(uint tokenId) external {

   require(eggNFT.getApproved(tokenId) == address(this), "Not approved");

   // ...

   }

   ​

   ​

2. Add Reentrancy Guards:

   import "@openzeppelin/contracts/security/ReentrancyGuard.sol";

   contract EggVault is Ownable, ReentrancyGuard {

   function withdrawEgg(uint tokenId) external nonReentrant { /* ... */ }

   }

   ​

   ​