Eggstravaganza

First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Severity: high
Invalid

No Approval Check Before Transfer

Summary

withdrawEgg in EggVault contract calls eggNFT.transferFrom without verifying that the vault is approved to transfer the NFT. If approval is revoked (e.g., by a malicious user after deposit), the call will fail.

Vulnerability Details

Impact

Withdrawal can be blocked, locking NFTs in the vault.

Tools Used

manual review

Recommendations

Check approval or use safeTransferFrom

require(eggNFT.getApproved(tokenId) == address(this), "Vault not approved");
eggNFT.transferFrom(address(this), msg.sender, tokenId);
Updates

Lead Judging Commences

m3dython Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!