Summary

The depositEgg function updates the eggDepositors mapping using the provided depositor address, but it does not verify that the token actually belongs to the depositor.

Vulnerability Details

The function lacks a check to ensure that the depositor is the actual owner of the tokenId. This allows any caller to assign any address as the depositor, regardless of ownership.

Impact

False depositor attribution — someone can claim another user's egg as theirs.

Could lead to exploits in reward systems, scoring, or ownership claims.

Tools Used

Manual review

Recommendations

Add an ownership check before assigning the depositor:

require(eggNFT.ownerOf(tokenId) == depositor, "Depositor is not the NFT owner");