Eggstravaganza

Summary

The EggstravaganzaNFT contract's functionality is contingent on proper initialisation of the gameContract address via setGameContract. If the owner fails to execute this function, the protocol becomes permanently non-functional as the mintEgg method remains inaccessible. While not directly exploitable, this represents a critical deployment failure vector.

Vulnerability Details

Affected Code:

Technical Analysis:

1. Uninitialised State Risk:

   • The gameContract state variable defaults to address(0)

   • The setGameContract function is the only way to configure this critical parameter

   • No initialisation occurs in the constructor

2. Protocol Bricking Scenario:

   • If owner neglects to call setGameContract after deployment

   • mintEgg becomes permanently unreachable

   • Entire game functionality is paralysed as no NFTs can be minted

3. Key Constraints:

   • Represents a single point of failure in protocol initialisation

Impact

Severity: High

• Protocol-Wide Failure: Renders core game mechanics permanently inoperable

• Irreversible Damage: Requires contract redeployment if initialisation is missed

Likelihood: Medium

• Depends on human operational processes during deployment

• Common in rushed deployments without proper verification

Tools Used

Manual code analysis of initialisation flows

Recommendations

1. Constructor Initialisation:

Remove Owner Dependency:

• Delete the setGameContract function entirely to prevent post-deployment misconfiguration