Submission Details
Severity:
Owner Privileges Could Disrupt Game Flow
Summary
Owner can change contract addresses and game parameters at any time, potentially disrupting an active game.
Vulnerability Details
The owner can call setGameContract(), setEggNFT(), endGame(), etc. at any time, even during an active game session.
Impact
Could lead to inconsistent game state, unexpected failures, or even allow a malicious or compromised owner to manipulate gameplay unfairly
Tools Used
Code Review
Recommendations
Add game state checks to sensitive functions and consider implementing a time lock for critical changes:
// In EggstravaganzaNFT
function setGameContract(address _gameContract) external onlyOwner {
require(!EggHuntGame(gameContract).gameActive(), "Cannot change during active game");
// Rest of function
}
Updates
Lead Judging Commences
m3dython 8 months ago
Submission Judgement Published Assigned finding tags:
Incomplete end game handling
Incorrect values reported when a game is ended early
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.