Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing approval verification in depositEggToVault leads to confusing user experience

teoslaf

Summary

The EggHuntGame::depositEggToVault function attempts to transfer NFTs without first verifying that the contract has been approved to transfer the tokens, leading to confusing error messages for users.

Vulnerability Details

The function comment states that "The player must first approve the transfer on the NFT contract," but the function does not verify this approval before attempting the transfer:

## EggHuntGame.sol
​
function depositEggToVault(uint256 tokenId) external {
require(eggNFT.ownerOf(tokenId) == msg.sender, "Not owner of this egg");
// The player must first approve the transfer on the NFT contract.
eggNFT.transferFrom(msg.sender, address(eggVault), tokenId);
eggVault.depositEgg(tokenId, msg.sender);
}

If a user calls this function without first approving the transfer, the transaction will revert with a generic ERC721 error message that may be confusing to users who are not familiar with the ERC721 approval mechanism.

Impact

  • Poor user experience when transactions fail without clear error messages

  • Increased support burden to explain the approval process to users

  • Potential confusion for users who don't understand why their transactions are failing

Tools Used

  • Manual code review

Recommendations

Add explicit approval verification with a clear error message:

function depositEggToVault(uint256 tokenId) external {
require(eggNFT.ownerOf(tokenId) == msg.sender, "Not owner of this egg");
+
+ // Check if this contract is approved to transfer the token
+ require(
+ eggNFT.getApproved(tokenId) == address(this) ||
+ eggNFT.isApprovedForAll(msg.sender, address(this)),
+ "Game not approved to transfer this egg. Call approve() first"
+ );
// The player must first approve the transfer on the NFT contract.
eggNFT.transferFrom(msg.sender, address(eggVault), tokenId);
eggVault.depositEgg(tokenId, msg.sender);
}
Updates

Lead Judging Commences

m3dython Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.