Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Decentralization risk of `EggstravaganzaNFT` owner setting a random `gameContract` address or `EggHuntGame` owner setting a higher `eggFindThreshold` to mint NFTs.

skaltso

Description:
The EggstravaganzaNFT owner can set a new gameContract through EggstravaganzaNFT::setGameContract. It can be any random address, including the owner himself, which then can mint any egg NFTs with tokenIds that haven't been minted before.
The EggHuntGame owner can set a high eggFindThreshold through EggHuntGame::setEggFindThreshold function allowing for a bigger chance of winning an NFT for a particular amount of time.

Impact:
Undermines fairness in finding egg NFts and dilutes scarcity.

Proof of Concept:

I. Random address minting.

  1. EggstravaganzaNFT owner changes the gameContract to himself.

  2. Owner mints an egg to himself.

  3. Owner changes back the gameContract to previous contract.

II. Higher chance of minting.

  1. EggHuntGame owner changes the eggFindThreshold to 100.

  2. Owner searches for an egg and always finds one.

  3. Owner changes back the eggFindThreshold to previous value.

Proof of Code:
Place the following tests inside EggGameTest:

function testRandomAddressCanMintNFTs() public {
vm.prank(owner);
nft.setGameContract(owner);
​
vm.prank(owner);
nft.mintEgg(owner, 20);
​
assertEq(nft.ownerOf(20), owner);
}
​
function testAlwaysFindsEgg(address fuzzAddress) public {
if (fuzzAddress == address(0)) {
return;
}
vm.startPrank(owner);
game.setEggFindThreshold(100);
game.startGame(100);
vm.stopPrank();
​
vm.prank(fuzzAddress);
game.searchForEgg();
​
assertEq(nft.ownerOf(1), fuzzAddress);
}

Recommended Mitigation:

  1. Allow gameContract initialization in EggstravaganzaNFT and eggFindThreshold initialization in EggHuntGame once. However, no other gameContracts can be used that way and eggFindThreshold couldn't be changed.

  2. Use a DAO.

  3. Use a MultiSig wallet.

Updates

Lead Judging Commences

m3dython Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Trusted Owner

Owner is trusted and is not expected to interact in ways that would compromise security

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.