Submission Details
Severity:
The owner can change the `EggVault::eggNFT` address after users have deposited into the vault, which could prevent users from withdrawing their NFTs
Description: The EggVault::setEggNFT function is restricted to the owner, which is good. However, there is no mechanism to prevent the owner from maliciously changing the NFT contract address after deposits have been made.
Impact: Changing the NFT address makes it impossible for users to withdraw their NFTs, effectively locking all deposited assets in the vault
Recommended Mitigation: Add a one-time initialization for the NFT contract or require a timelock for changes.
Updates
Lead Judging Commences
m3dython 9 months ago
Submission Judgement Published Assigned finding tags:
State corruption
Changing the NFT contract address doesn't update the storedEggs and eggDepositors mappings
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.