Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Owner-Controlled Egg Find Threshold Can Be Set To 0

0xalipede

Summary

The EggHuntGame contract allows the owner to modify the eggFindThreshold without any minimum limit. This means the owner could set the threshold to 0, making it impossible for players to win NFTs. Additionally, the owner could front-run players by adjusting the threshold dynamically to control the outcome of the game.

Vulnerability Details

Affected code:

The setEggFindThreshold function allows the contract owner to set the probability of finding an egg:

function setEggFindThreshold(uint256 newThreshold) external onlyOwner {
require(newThreshold <= 100, "Threshold must be <= 100");
eggFindThreshold = newThreshold;
}

However, there is no minimum threshold enforcement allowing the owner to set eggFindThreshold = 0, preventing players from finding any eggs. Addinionally, the owner can observe pending transactions and adjust eggFindThreshold in response to user interactions.
For example, if a player attempts to search for an egg, the owner can increase or decrease the threshold before the transaction is executed, influencing the outcome unfairly.

Impact

  • The owner can prevent users from winning by setting eggFindThreshold = 0, making the game unplayable.

  • Players may lose trust in the fairness of the game if they suspect owner manipulation.

  • If NFTs have value, the owner could dynamically adjust eggFindThreshold to favor certain players or manipulate NFT supply.

Tools Used

  • Manual review

Recommendations

I would recommend implementing a minimum treshold requirement like at least 10%.

function setEggFindThreshold(uint256 newThreshold) external onlyOwner {
- require(newThreshold <= 100, "Threshold must be <= 100");
+ require(newThreshold >= 10 && newThreshold <= 100, "Threshold must be between 10 and 100");
eggFindThreshold = newThreshold;
}
Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Trusted Owner

Owner is trusted and is not expected to interact in ways that would compromise security

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.