Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Allows early game termination without checking endTime

ryzen_xp

Summary

  • Contract: EggHuntGame

  • Function Audited: endGame()

  • Issue Identified: Lack of endTime check in the endGame() function.

  • Impact: Game can be ended earlier than the duration agreed upon, affecting fairness.

  • Status: Unresolved (fix recommended)

Vulnerability Details

The endGame() function allows the game owner to manually terminate the game at any time after it starts, without verifying whether the game's predefined duration (endTime) has passed.

function endGame() external onlyOwner {
require(gameActive, "Game not active");
gameActive = false;
emit GameEnded(block.timestamp);
}
​

This means the owner could end the game prematurely, violating the expected behavior established in the startGame() function, which sets a minimum duration (MIN_GAME_DURATION) and calculates endTime.

Impact

  • Loss of Fairness: Players expect the game to last for the entire duration set during startGame(). Premature termination breaks this trust.

  • Reputation Risk: If players observe games ending unexpectedly early, it could damage the credibility of the platform or dApp.

  • Potential Exploitation: Malicious or impatient owners could stop the game early to prevent others from earning rewards or participating equally.

Tools Used

  • Manual review of the smart contract code.

Recommendations

Modify the endGame() function to enforce that the game can only be ended once the endTime has passed.

✅ Suggested Fix:

function endGame() external onlyOwner {
require(gameActive, "Game not active");
require(block.timestamp >= endTime, "Cannot end before game duration expires");
gameActive = false;
emit GameEnded(block.timestamp);
}
​
Updates

Lead Judging Commences

m3dython Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Trusted Owner

Owner is trusted and is not expected to interact in ways that would compromise security

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.