Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Deposit of egg NFTs into vault after game ended

iamthesvn

Summary

The depositEggToVault function in the EggHuntGame contract allows players to deposit eggs into the vault even after the game has ended.

Vulnerability Details

The depositEggToVault function currently lacks a check to verify whether the game has ended before allowing the deposit of an egg. Specifically, the function does not ensure that the game is still active and within the allowed time frame for deposits.

function depositEggToVault(uint256 tokenId) external {
require(eggNFT.ownerOf(tokenId) == msg.sender, "Not owner of this egg");
// The player must first approve the transfer on the NFT contract.
eggNFT.transferFrom(msg.sender, address(eggVault), tokenId);
eggVault.depositEgg(tokenId, msg.sender);
}

Impact

Players can deposit eggs into the vault after the game has ended, which may not be the intended behavior.

Tools Used

Manual review

Recommendations

Modify the depositEggToVault function to include checks that ensure the game is still active and within the allowed time frame before allowing the deposit of an egg.

Updates

Lead Judging Commences

m3dython Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!