Submission Details
Severity:
No Check for Existing Token IDs
Summary
mintEgg in the EggstravaganzaNFT Contract doesn’t verify if tokenId already exists. ERC-721 requires unique token IDs, but if the caller (e.g., EggHuntGame) passes a duplicate tokenId, it will overwrite the existing token’s ownership via _mint.
Vulnerability Details
Impact
Loss of uniqueness
potential overwrite of existing NFTs.
Tools Used
Recommendations
Use _safeMint with an internal counter or check _exists(tokenId) before minting
function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
require(!_exists(tokenId), "Token already minted");
_safeMint(to, tokenId);
totalSupply += 1;
return true;
}
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.