Eggstravaganza

Summary

Game Owner is able to call EggHuntGame::setEggFindThreshold during an active game, without triggering a cool-down period or providing any time for Players to react to the changes. Furthermore, the Game Owner is able to do this 'silently', without emitting any event to alert Players to the change.

Vulnerability Details

To set the chance that a Player will discover an egg, the Game Owner is able to call the following function:

The function has no check in place to ensure gameActive is true and emits no event when called to modify the threshold. This may lead to Players being ignorant of the changes, which could be a drastic reduction in the odds that they will succeed in discovering an egg, or the Game Owner may conspire to guarantee discovery for a Player, etc.

Impact

This vulnerability has an Indirect impact on the funds or the protocol's functionality, allowing Game Owner to effect the game outcome.

Tools Used

Manual review.

Recommendations

It is recommended that a time-lock be implemented for the critical property changes and emit proper events. As the contract tracks the game state using gameActive, a check for this will prevent change during an active game. In addition, an event should be emitted to alert Players to critical changes in game state: