Eggstravaganza

Summary:

Hi,

I have found out a potential vulnerability in the smart contract EggHuntGame.sol which can leads to reentrancy in the function endGame.

Vulnerability Details:

The key details of the potential vulnerability can be given as follows:

In function endGame, the unsafe operation eggNFT.transferFrom above depositEgg leads to reentrancy as it doesn't check for the deposit balance of the user in the contract before sending the NFT reward to the user and attacker can exploit it by calling the function again and again results in extracting rewards from the vault.

Impact:

The attacker can extract all the rewards from the game vault and leads to drainage of rewards by creating DoS situation.

Tools Used:

Manual review + VS Code

Recommendations:

Use Openzeppelin's ReentranncyGuard to prevent reentrancy attack.

Reference:

https://www.cyfrin.io/blog/what-is-a-reentrancy-attack-solidity-smart-contracts