Submission Details
Severity:
Improper validation of egg find threshold allows game disruption
Vulnerability Details
The setEggFindThreshold function allows the owner to set the eggFindThreshold to any value between 0 and 100, inclusive. However, setting the threshold to 0 or 100 breaks the core game mechanic.
/// @notice Allows the owner to adjust the egg-finding chance.
function setEggFindThreshold(uint256 newThreshold) external onlyOwner {
require(newThreshold <= 100, "Threshold must be <= 100");
//@audit-issue shouldn't be able to set to 0 or 100
eggFindThreshold = newThreshold;
}
Impact
Setting the threshold to 0 makes it impossible for players to find eggs, while setting it to 100 guarantees an egg find on every search attempt, trivializing the game and potentially allowing rapid minting of NFTs.
Recommendation
Modify the setEggFindThreshold function to ensure the newThreshold is strictly greater than 0 and strictly less than 100.
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.