Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Multi-sig Wallet Recipient Issues

0xshaedyw

Summary

  • When multi-sig wallets win NFTs, they're minted to the multi-sig address instead of individual players, causing access problems.

Vulnerability Details

  • Issue:

    • Multi-sig wallets are typically used as transaction signers, not asset holders

    • NFTs minted to multi-sig addresses require additional internal approvals

  • Example:

    • Player uses Gnosis Safe as msg.sender

    • NFT gets stuck in Safe without easy transfer mechanism

Impact

  • Degraded UX, potential NFT lockup in multi-sigs

Tools Used

  • Manual analysis of user flows

Recommendations

  • Add recipient parameter to game functions:

function searchForEgg(address recipient) external {
// ...game logic...
eggNFT.mintEgg(recipient, eggCounter);
}

  • Or implement meta-transactions for delegated minting

Updates

Lead Judging Commences

m3dython Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.