Submission Details
Severity:
No Reentrancy Protection
Summary
Vulnerability Details
withdrawEgg in EggVault contract calls transferFrom, an external call to eggNFT. If EggstravaganzaNFT were modified to include callbacks (e.g., via onERC721Received), a reentrancy attack could repeatedly withdraw the same NFT before storedEggs is set to false.
Impact
Loss of NFTs due to reentrancy.
Tools Used
Recommendations
Add a non-reentrant modifier (e.g., OpenZeppelin’s ReentrancyGuard):
import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
contract EggVault is Ownable, ReentrancyGuard {
function withdrawEgg(uint256 tokenId) public nonReentrant { ... }
}
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.