Submission Details
Severity:
The function EggHuntGame.searchForEgg() can be called many times get lots of eggs
Summary
The function EggHuntGame.searchForEgg()can be called many times.
Vulnerability Details
The function EggHuntGame.searchForEgg()doesn't set the number that a user can call times,causing attacker can call this function any times.
function searchForEgg() external {
// @audit -high this function is not protected against reentrancy attacks
require(gameActive, "Game not active");
require(block.timestamp >= startTime, "Game not started yet");
require(block.timestamp <= endTime, "Game ended");
uint256 random = uint256(
keccak256(abi.encodePacked(block.timestamp, block.prevrandao, msg.sender, eggCounter))
) % 100;
if (random < eggFindThreshold) {
eggCounter++;
eggsFound[msg.sender] += 1;
eggNFT.mintEgg(msg.sender, eggCounter);
emit EggFound(msg.sender, eggCounter, eggsFound[msg.sender]);
}
}
Impact
Attacker can call this function any times until finds the egg.
Tools Used
manureview
Proof Of Code
attacker call the function searchForEgg in a loop until find the egg.
address attacker = makeAddr("attacker");
function testsearchforegganytimes() public {
// Start the game with a duration.
uint256 duration = 200;
game.startGame(duration);
uint256 previousEggCounter = game.eggCounter();
console2.log("previousEggCounter", previousEggCounter);
vm.startPrank(attacker);
while (true){
game.searchForEgg();
if (game.eggCounter() > 0){
break;
}
// skip the time
skip(1);
}
vm.stopPrank();
uint256 attackereggcounter = game.eggsFound(address(attacker));
console2.log("attackereggcounter", attackereggcounter);
}
Recommendations
Set a number a user can call this function to limit the times entering this function
Updates
Lead Judging Commences
m3dython 8 months ago
Submission Judgement Published Assigned finding tags:
No rate limiting
Contract lacks any cooldown mechanism, search limits, or costs in the searchForEgg() function
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.