Summary

The depositEgg function in the EggVault contract does not validate that the depositor address matches the rightful owner of the NFT. This allows an attacker to front-run a legitimate user and register a malicious address as the depositor, effectively hijacking the egg.

Vulnerability Details

The function accepts a depositor parameter without validation. This lets any user call depositEgg with any arbitrary address, which is then stored in the eggDepositors mapping. An attacker can front-run a pending legitimate deposit and insert their own address, allowing them to later withdraw the egg using withdrawEgg.

Impact

Attackers can claim ownership of NFTs by front-running deposits, leading to unauthorized withdrawals and potential permanent loss of user assets.

Tools Used

Manual code review

Recommendations

• Remove the depositor parameter from depositEgg.

• Use msg.sender or a trusted address like EggHuntGame that manages user assets as the depositor, ensuring accurate ownership tracking.