Submission Details
Severity:
gameContract contract address can be updated at any time
[M-4] gameContract contract address can be updated at any time
Description: EggstravaganzaNFT:setGameContract can be called and change the address of the game contract at any time.
Impact: If the gameContract is set to a new address after mintEgg has been called, the original game contract would no longer be able to mint Eggs.
Recommended Mitigation: Pass in the gameContract contract address to the EggstravaganzaNFT contructor to ensure it is initialized and remove the EggstravaganzaNFT:setGameContract function.
+ constructor(string memory _name, string memory _symbol, address _gameContract)
ERC721(_name, _symbol) Ownable(msg.sender);
+ gameContract = _gameContract;
- constructor(string memory _name, string memory _symbol)
ERC721(_name, _symbol) Ownable(msg.sender)
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.