Eggstravaganza

Summary

The current logic requires the true owner of an egg NFT to first transfert to the vault, and then call the depositEgg function. If an attacker backruns the NFT transfer to the vault, they can claim the ownership of the deposited egg to the vault.

Vulnerability Details

The depositEgg function does not check that the depositor is the real owner of the NFT that has been deposited.

1. NFTowner transfers the egg NFT N to the vault

2. attacker calls depositEgg(N, attackerAddress

3. attacker calls withdrawEgg(N)and gets steals the NFT

Impact

A legit owner of a deposited egg could loss ownership to an attacker after transfering the egg NFT to the vault.

Tools Used

Manual review.

Recommendations

The depositEgg function should take care of the NFT transfer itself to prevent backrun attack.