Eggstravaganza

Summary

Assumes NFT was transferred before calling, but no enforcement.

Vulnerability Details

see depositEgg() for details

Impact

Tools Used

Recommendations

see here for fix snippet

function depositEgg(uint256 tokenId) external {

require(eggNFT.ownerOf(tokenId) == msg.sender, "Not NFT owner");

eggNFT.transferFrom(msg.sender, address(this), tokenId); // Move NFT first

storedEggs[tokenId] = true;
eggDepositors[tokenId] = msg.sender;

emit EggDeposited(msg.sender, tokenId);

}