Submission Details
Severity:
Potential Reentrancy, State change after external call in `EggVault::depositEgg`
Description:
The EggHuntGame::depositEggToVault(uint256 tokenId) function calls the eggNFT.transferFrom() (external call), then proceeds to call depositEgg(), which updates critical state variables. In this case, EggstravaganzaNFT is a trusted contract with no reentrant behavior and transferFrom() does not invoke external code. However, the pattern should be treated with caution.
Recommended Mitigation:
Apply the nonReentrant modifier (from OpenZeppelin’s ReentrancyGuard) on depositEgg() and withdrawEgg() for extra protection.
contract EggVault is Ownable, ReentrancyGuard {
...
function depositEgg(...) public nonReentrant { ... }
}
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.