Summary

The getTimeRemaining() function in the EggHuntGame contract does not account for the game being manually ended through the endGame() function, leading to misleading information about the game state.

Vulnerability Details

The getTimeRemaining() function only checks if the current time has exceeded the scheduled end time, but ignores the gameActive state variable:

Even after the owner calls endGame() to end the game prematurely, this function will still return a non-zero value until the originally scheduled end time is reached.

Impact

• Misleading information provided to users and frontend applications

• Potential confusion about whether the game is still active

• Inconsistency between the game's actual state and the reported remaining time

Scenario:

1. Owner starts a game with a duration of 1 hour

2. After 30 minutes, the owner calls endGame() to end the game prematurely

3. The game is no longer active (gameActive == false)

4. However, getTimeRemaining() will still return 30 minutes

5. This creates confusion as users might think they still have time to participate

Tools Used

Manual review

Recommendations

Modify the getTimeRemaining() function to also check the gameActive state variable:

This change ensures that the function returns 0 when the game has been manually ended, providing consistent and accurate information to users and frontend applications.