Summary

The function allows arbitrary token IDs instead of using totalSupply + 1.

Vulnerability Details

• This could cause duplicate token IDs if gameContract calls mintEgg() with a reused tokenId.

• OpenSea and other marketplaces might reject duplicate NFTs.

Impact

• Potential NFT duplication.

• Marketplace compatibility issues.

Tools Used

• Manual review.

Recommendations

• Modify mintEgg() to use totalSupply + 1:

  function mintEgg(address to) external returns (bool) {

  require(msg.sender == gameContract, "Unauthorized minter");

  totalSupply++;

  _mint(to, totalSupply);

  return true;

  }*

  ​

• This prevents duplicate token minting.