Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

`searchForEgg()` Does Not Check the Return Value of `mintEgg()`

0xbyteknight

Summary

The searchForEgg() function in EggHuntGame.sol calls eggNFT.mintEgg(msg.sender, eggCounter) without verifying its return value. This can lead to false assumptions that the NFT was successfully minted, even if the call silently fails.

Vulnerability Details

In the current implementation of searchForEgg():

if (random < eggFindThreshold) {
eggCounter++;
eggsFound[msg.sender] += 1;
-> eggNFT.mintEgg(msg.sender, eggCounter); // ❌ Return value is ignored
emit EggFound(msg.sender, eggCounter, eggsFound[msg.sender]);
}

The mintEgg() function in EggstravaganzaNFT.sol returns a boolean to indicate success. Ignoring this return value means that the game may:

  • Increment eggCounter and update eggsFound

  • Emit the EggFound event

  • But fail to mint the NFT

This creates a mismatch between the on-chain state and actual token ownership. A player may appear to have found an egg, but not actually own the corresponding NFT.

Impact

  • Silent failure: If mintEgg() fails (e.g., if gameContract is not properly set), the contract will act as if the mint succeeded.

  • Broken accounting: The internal eggCounter and eggsFound values can be inconsistent with real NFT ownership.

  • Event inconsistency: EggFound events may be emitted even when no NFT was minted.

Tools Used

  • Manual Code Review

Recommendations

Check the return value of mintEgg() and revert if it fails:

- eggNFT.mintEgg(msg.sender, eggCounter);
+ bool success = eggNFT.mintEgg(msg.sender, eggCounter);
+ require(success, "Failed to mint egg NFT");
Updates

Lead Judging Commences

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Unused return value

Returns a boolean value that isn't utilized by its caller

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.