Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Missing initialization controls in EggstravaganzaNFT could lead to system failure

teoslaf

Summary

The EggstravaganzaNFT contract lacks proper initialization controls for the critical gameContract parameter, creating a risk of complete system failure if initialization is forgotten or performed incorrectly.

Vulnerability Details

The NFT contract relies on the owner to set the game contract address after deployment, but there are no safeguards around this critical initialization step:

## EggstravaganzaNFT.sol
​
function setGameContract(address _gameContract) external onlyOwner {
require(_gameContract != address(0), "Invalid game contract address");
gameContract = _gameContract;
}

If the owner forgets to call setGameContract after deployment:

  1. The gameContract variable remains uninitialized (address(0))

  2. All calls to mintEgg will revert with "Unauthorized minter" since no contract is authorized

  3. The entire game system becomes non-functional as players cannot receive eggs

Impact

  • If initialization is forgotten, the entire game system becomes non-functional

  • No eggs can be minted, breaking the core functionality of the game

  • No clear error messages to indicate what went wrong

  • Requires redeployment of contracts to fix

Tools Used

  • Manual code review

Recommendations

Implement proper initialization controls:

constructor(
string memory _name,
string memory _symbol,
+ address _initialGameContract
- ) ERC721(_name, _symbol) Ownable(msg.sender) {}
+ ) ERC721(_name, _symbol) Ownable(msg.sender) {
+ require(_initialGameContract != address(0), "Invalid game contract address");
+ gameContract = _initialGameContract;
+ emit GameContractChanged(address(0), _initialGameContract);
+ }

This ensures the game contract is set during deployment, eliminating the risk of forgotten initialization.

Updates

Lead Judging Commences

m3dython Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Trusted Owner

Owner is trusted and is not expected to interact in ways that would compromise security

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.