Eggstravaganza

Summary

The depositEgg function in EggVault is public and lacks validation of the caller, allowing anyone to falsely record deposits.

Vulnerability Details

• The function assumes the NFT was already transferred to the vault but doesn’t enforce that the caller (msg.sender) is the gameContract or the depositor.

• An attacker can call depositEgg with any tokenId and depositor address, corrupting vault records.

Impact

• Malicious users can spoof deposits, locking legitimate users out of withdrawals or stealing eggs.

Tools Used

Manual review of function visibility and logic.

Recommendations

• Restrict depositEgg to only be callable by the gameContract using onlyGameContract modifier.

• Add explicit checks that msg.sender is the depositor or an approved contract.