Submission Details
Severity:
Lack of Emergency Withdraw Mechanism
Summary:
The EggVault contract lacks any emergency recovery option for stuck NFTs.
Vulnerability Details
If:
The NFT contract becomes locked or upgraded
The vault contract has a bug
Ownership needs to be migrated
There's no way to recover NFTs without deploying new contracts.
Impact
Medium - Could lead to permanent loss of assets in edge cases.
Tools Used
Manual Review
Recommendations
Add timelocked emergency withdraw function:
function emergencyWithdraw(uint256 tokenId, address to) external onlyOwner {
require(block.timestamp > unlockTime, "Timelocked");
eggNFT.transferFrom(address(this), to, tokenId);
}
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.