Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Owner Privilege Abuse in Egg-Finding Threshold Setting

elyas6126

Summary:

function setEggFindThreshold(uint256 newThreshold) external onlyOwner {
require(newThreshold <= 100, "Threshold must be <= 100");
eggFindThreshold = newThreshold;
}

The setEggFindThreshold function allows the owner to change the egg-finding threshold during the game, leading to unfair advantages.

Vulnerability Details

The setEggFindThreshold(uint256 newThreshold) function lets the owner change the difficulty of finding eggs at any time, even during an active game. This opens the door for unfair manipulation:

  • The owner can increase the threshold to favor specific players.

  • The owner can decrease it to make the game harder for others.

  • Players can't trust that the rules will stay consistent throughout the game.

This breaks the fairness and predictability essential for trust in game-based smart contracts.

function testOwnerCanChangeThresholdWhileGameIsActive() public {
game.startGame(100);
game.setEggFindThreshold(50);
assertEq(game.eggFindThreshold(), 50);
}

Impact

  1. Unfair Advantage
    The owner can manipulate the difficulty to favor specific players by lowering the threshold when they play.

  2. Player Trust Loss
    Honest players may lose trust in the game, knowing the rules can change at any time.

  3. Economic Exploitation
    the owner can exploit the system for financial gain.

  4. Centralization Risk
    The game appears decentralized, but this ability reveals hidden central control over critical gameplay mechanics.

  5. Reputation Damage
    Projects with manipulable game logic can lose credibility and community support.

Tools Used

manual review

Recommendations

Add a check to ensure the egg-finding threshold can only be changed when the game is not active. This prevents rule changes during gameplay and ensures fairness for all participants.

function setEggFindThreshold(uint256 newThreshold) external onlyOwner {
+ require(!activeGame, "Game is active);
require(newThreshold <= 100, "Threshold must be <= 100");
eggFindThreshold = newThreshold;
}
​

Updates

Lead Judging Commences

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Trusted Owner

Owner is trusted and is not expected to interact in ways that would compromise security

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.