Eggstravaganza

Summary

The withdrawEgg function in EggVault performs an external call (transferFrom) before updating state, opening a reentrancy attack vector.

Vulnerability Details

• The function updates storedEggs and eggDepositors after transferring the NFT.

• If eggNFT is a malicious contract overriding onERC721Received, it could re-enter withdrawEgg to drain the vault.

Impact

• An attacker could recursively withdraw the same egg multiple times or manipulate vault state.

Tools Used

Manual review of state changes and external calls.

Recommendations

• Follow Checks-Effects-Interactions (CEI) pattern: update state before calling transferFrom.

• Use OpenZeppelin’s ReentrancyGuard for critical functions.