Submission Details
Severity:
Lack of maximum duration check allows for indefinite game length
Vulnerability Details
The startGame function in EggHuntGame.sol allows the owner to set the game's duration. While it checks for a minimum duration (MIN_GAME_DURATION), it does not enforce any maximum duration limit.
/// @notice Starts the egg hunt game for a specified duration.
function startGame(uint256 duration) external onlyOwner {
require(!gameActive, "Game already active");
require(duration >= MIN_GAME_DURATION, "Duration too short");
startTime = block.timestamp;
//@audit-issue no max duration
endTime = block.timestamp + duration;
gameActive = true;
emit GameStarted(startTime, endTime);
}
Impact
The owner can set an extremely long game duration, potentially locking the contract state indefinitely and preventing future games from being started or the current one from concluding in a reasonable timeframe.
Recommendation
Implement an upper bound check for the game duration parameter in the startGame function.
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.