Eggstravaganza

Summary

The endGame() function can be called by the owner at any time, even before the scheduled end time, potentially disrupting the game unfairly.

Vulnerability Details

The endGame() function has insufficient validation:

While it checks that the game is active, it doesn't validate that the game's scheduled end time has passed. This allows the owner to arbitrarily end the game early, which could be unfair to participants who expected a specific game duration.

Impact

Medium. This vulnerability enables:

• Premature termination of the game by the owner

• Potential manipulation of game outcomes

• Loss of trust in the fairness of the game

Tools Used

Manual code review

Recommendations

1. Add a check to ensure the current time is past the scheduled end time

2. Or add a flag parameter to explicitly allow early termination in exceptional cases

3. Emit an event with the reason for early termination if allowed

1. Adds an emergency parameter to allow for early termination only in exceptional circumstances

2. Requires the current time to be past the scheduled end time unless it's an emergency

3. Emits different events depending on whether it's a normal or emergency end

4. Adds a specific event for emergency endings that includes who initiated it

This approach:

• Protects players from arbitrary early termination

• Provides transparency when games are ended early

• Still allows for emergency stops when absolutely necessary

• Creates an audit trail of who initiated emergency stops and when

This solution balances owner control with player protection, addressing the medium-severity vulnerability while maintaining flexibility for legitimate use cases.