Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

EggstravaganzaNFT contract address can be updated while the game is active

graves

[M-1] EggstravaganzaNFT contract address can be updated while the game is active

Description: EggVault:setEggNFT can be called and change the address of the NFTs while the game is active causing EggHuntGame:eggCounter and EggHuntGame:eggsFound to hold incorrect data.

Impact: If the NFT contract is set to a new address while the game is active the data and Events from the EggHuntGame contract will be incorrect

Recommended Mitigation: Pass in the EggstravaganzaNFT contract address to the contructor to EggVault to ensure it is initialized and remove the EggVault:setEggNFT function.

+ constructor(address _eggNFT)Ownable(msg.sender){
+ setEggNFT(_eggNFT);
+ }
- constructor()Ownable(msg.sender){}
- /// @notice Set the NFT contract address.
- function setEggNFT(address _eggNFTAddress) public onlyOwner {
- require(_eggNFTAddress != address(0), "Invalid NFT address");
- eggNFT = EggstravaganzaNFT(_eggNFTAddress);
- }
Updates

Lead Judging Commences

m3dython Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

State corruption

Changing the NFT contract address doesn't update the storedEggs and eggDepositors mappings

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!