Summary

The depositEgg() function allows anyone to mark an NFT as deposited if it is already in the contract.

Vulnerability Details

• A malicious user could send an NFT to the contract and call depositEgg() to claim they deposited it.

• This could allow an attacker to withdraw NFTs they never actually owned.

Impact

• Unauthorized NFT withdrawals.

• Attackers could steal NFTs by front-running legitimate deposits.

Tools Used

• Manual review.

Recommendations

• Change depositEgg() to verify that the depositor is the true owner before transferring:

  function depositEgg(uint256 tokenId) external {

  require(eggNFT.ownerOf(tokenId) == msg.sender, "Not the NFT owner");

  eggNFT.transferFrom(msg.sender, address(this), tokenId);

  storedEggs[tokenId] = true;

  eggDepositors[tokenId] = msg.sender;

  emit EggDeposited(msg.sender, tokenId);

  }

• This ensures only real owners can deposit.