Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

MIN_GAME_DURATION can be bypassed because EggHuntGame::endGame() does not check if the required duration has passed.

vanshikag

Summary

The EggHuntGame contract contains a variable MIN_GAME_DURATION which defines the minimum length of time, in seconds, for which a game has to last. When the contract owner starts the game, the duration they enter needs to be >= MIN_GAME_DURATION. This limitation can be bypassed by calling endGame() which has no checks on time. endGame() is not an emergency function and the owner cannot start a new game without calling this function. The limitation placed by the contract on game duration should be checked in this function.

/// @notice Ends the egg hunt game.
function endGame() external onlyOwner {
require(gameActive, "Game not active");
gameActive = false;
emit GameEnded(block.timestamp);
}

Impact

Limitation on game duration can be bypassed.

Proof of Concept

Copy the following into the test folder and run with forge test --mt testMinDurationBypass.

function testMinDurationBypass() public {
uint256 duration = 200;
game.startGame(duration); // start game for 200 seconds
uint256 remaining = game.getTimeRemaining();
assertEq(remaining, duration);
game.endGame(); // end game early, bypassing the time limit
assertEq(game.gameActive(), false);
remaining = game.getTimeRemaining();
assertEq(remaining, duration);
}

Expected result:

[⠢] Compiling...
No files changed, compilation skipped
​
Ran 1 test for test/EggHuntGameTest.t.sol:EggGameTest
[PASS] testMinDurationBypass() (gas: 64849)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 465.10µs (61.29µs CPU time)
​
Ran 1 test suite in 3.59ms (465.10µs CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests)

Recommendation

Check if the game duration has passed before executing EggHuntGame::endGame().

Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incomplete end game handling

Incorrect values reported when a game is ended early

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.