Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Incomplete Game State Management

zhouhuan19910202

Summary

The endGame function in the EggHuntGame contract fails to properly reset game state, potentially leading to state confusion between game cycles and possible game mechanic exploits.

Vulnerability Details

The current endGame function only updates the gameActive flag without resetting other game state variables:

function endGame() external onlyOwner {
require(gameActive, "Game not active");
gameActive = false;
emit GameEnded(block.timestamp);
}

This means that key game states like eggCounter, startTime, and endTime remain unchanged after a game ends. If the game is restarted, these persistent states could lead to inconsistencies or unexpected behavior.

Impact

  1. State confusion between game cycles

  2. Potential inconsistencies in NFT ID sequencing

  3. Game logic errors and unpredictable behavior

  4. Possible game mechanic exploits

Tools Used

  • Manual code review

  • State management analysis

Recommendations

Implement a comprehensive state reset mechanism to ensure clear separation between game cycles:

function endGame() external onlyOwner {
require(gameActive, "Game not active");
gameActive = false;
// Optional: Save historical data
uint256 lastGameEggCounter = eggCounter;
// Reset game state
// Note: eggCounter might not be reset depending on game design
// eggCounter = 0;
startTime = 0;
endTime = 0;
emit GameEnded(block.timestamp);
}
​
// Or create a separate reset function
function resetGameState() external onlyOwner {
require(!gameActive, "Cannot reset while game is active");
// Reset game state
startTime = 0;
endTime = 0;
// Decide whether to reset eggCounter based on game design
}
Updates

Lead Judging Commences

m3dython Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incomplete end game handling

Incorrect values reported when a game is ended early

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.