Eggstravaganza

Summary

The depositEggToVault function assumes the player has approved the game contract to transfer their NFT, but doesn’t verify this.

Vulnerability Details

• If a user calls depositEggToVault without prior approval, the transferFrom call will revert, wasting gas.

• No explicit error message guides users to approve first.

Impact

• Poor UX and potential confusion, though no direct financial loss.

Tools Used

Manual review of ERC721 interaction patterns.

Recommendations

• Add a require(nft.isApprovedForAll(msg.sender, address(this)) || nft.getApproved(tokenId) == address(this)) check.

• Emit an event to inform users of required approvals.