Eggstravaganza

Summary

Malicious users can spoof deposits, corrupting vault state and enabling theft.

Vulnerability Details

Impact

Anyone can call depositEgg(), allowing fake deposits even if the NFT was never transferred.

Tools Used

manual review

Recommendations

this should be best implemented with this snippet

function depositEgg(uint256 tokenId) external {

require(eggNFT.ownerOf(tokenId) == msg.sender, "Not NFT owner");

eggNFT.transferFrom(msg.sender, address(this), tokenId); // Move NFT first

storedEggs[tokenId] = true;
eggDepositors[tokenId] = msg.sender;
emit EggDeposited(msg.sender, tokenId);
}