Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Missing initialization controls in EggVault leads to non-functional vault system

teoslaf

Summary

The EggVault contract requires manual initialization of the eggNFT parameter after deployment, creating a critical vulnerability where the entire vault system becomes non-functional if initialization is forgotten.

Vulnerability Details

The EggVault contract relies on the eggNFT address being set to function properly, but this parameter is not initialized in the constructor:

## EggVault.sol
​
constructor()Ownable(msg.sender){}
​
/// @notice Set the NFT contract address.
function setEggNFT(address _eggNFTAddress) external onlyOwner {
require(_eggNFTAddress != address(0), "Invalid NFT address");
eggNFT = EggstravaganzaNFT(_eggNFTAddress);
}

This creates a critical vulnerability:

  1. The eggNFT variable remains uninitialized (address(0)) after deployment

  2. All calls to depositEgg and withdrawEgg will revert with errors when trying to interact with the uninitialized NFT contract

  3. The entire vault system becomes non-functional until the owner manually calls setEggNFT

Impact

  • If initialization is forgotten, the entire vault system becomes non-functional

  • Users cannot deposit or withdraw eggs, breaking the core functionality of the vault

  • No clear error messages to indicate what went wrong

  • Requires manual intervention by the owner to fix

Tools Used

  • Manual code review

  • Initialization vulnerability analysis

Recommendations

Implement proper initialization controls by setting the NFT contract address in the constructor:

- constructor()Ownable(msg.sender){}
+ constructor(address _eggNFTAddress)Ownable(msg.sender){
+ require(_eggNFTAddress != address(0), "Invalid NFT address");
+ eggNFT = EggstravaganzaNFT(_eggNFTAddress);
+ emit EggNFTChanged(address(0), _eggNFTAddress);
+ }

This ensures the NFT contract is set during deployment, eliminating the risk of forgotten initialization.

Updates

Lead Judging Commences

m3dython Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Trusted Owner

Owner is trusted and is not expected to interact in ways that would compromise security

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.