Submission Details
Severity:
Centralization Risk in `setEggFindThreshold` Owner Can Disable or Guarantee Egg Drops.
Summary
In the `setEggFindThreshold()` owner can completely set a new threshold which can break the game functionality.
```javascript
function setEggFindThreshold(uint256 newThreshold) external onlyOwner {}
```
Which means that if the owner of the contract sets the `newThreshold` variable to `100` everyone that plays the game will get an egg but if it's at `0`, nobody will never win an egg.
Vulnerability Details
A centralization vulnerability occurs when a smart contract grants excessive control to a single entity (e.g., admin, owner, or privileged address)
Impact
This can lead to two things:
If `newThreshold` variable is set at `100`:
- Infinite NFTs minted
- Players exploit free drops
If `newThreshold` variable is set at `0`:
- Players can’t progress (eggs never found)
- NFTs become unobtainable
Proof Of Work
So past this two test in the `EggHUntGameTest.t.sol`:
```javascript
function test_100PercentThresholdExploit() public {
//When newThreshold = 100
game.startGame(200);
vm.prank(owner);
game.setEggFindThreshold(100);
// Test Alice's mint
vm.prank(alice);
game.searchForEgg();
assertEq(game.eggsFound(alice), 1, "Alice should get 1 egg");
// Test Bob's mint
vm.prank(bob);
game.searchForEgg();
assertEq(game.eggsFound(bob), 1, "Bob should get 1 egg");
// Test Enock's mint
vm.prank(enock);
game.searchForEgg();
assertEq(game.eggsFound(enock), 1, "Enock should get 1 egg");
// Verify total eggs minted
assertEq(game.eggCounter(), 3, "Should have minted 3 total eggs");
}
function test_0PercentThresholdBrick() public {
// Owner sets threshold to 0% (game bricked)
game.startGame(200);
vm.prank(owner);
game.setEggFindThreshold(0);
// Alice tries to play - should fail
vm.prank(alice);
game.searchForEgg();
assertEq(game.eggsFound(alice), 0, "Alice should get 0 eggs");
// Bob tries to play - should fail
vm.prank(bob);
game.searchForEgg();
assertEq(game.eggsFound(bob), 0, "Bob should get 0 eggs");
// Enock tries to play - should fail
vm.prank(enock);
game.searchForEgg();
assertEq(game.eggsFound(enock), 0, "Enock should get 0 eggs");
// Verify no eggs were minted
assertEq(game.eggCounter(), 0, "No eggs should be minted");
}
```
Recommendations
At least it's recommended to put a bound like this :
```diff
function setEggFindThreshold(uint256 newThreshold) external onlyOwner {
+ require(newThreshold >= 5 && newThreshold <= 50, "Threshold must be 5-50%");
eggFindThreshold = newThreshold;
emit ThresholdUpdated(newThreshold); // Log changes
}
```
Updates
Lead Judging Commences
m3dython 8 months ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
Trusted Owner
Owner is trusted and is not expected to interact in ways that would compromise security
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.