Eggstravaganza

Summary

The EggHuntGame.sol contract allows participants to mint egg NFTs by calling the searchForEgg() function. However, there are no limits on how many times a user can call this function, and no overall cap on the number of NFTs that can be minted. This introduces a vulnerability where an attacker can mint a large number of NFTs in a short period of time, leading to inflation and undermining the value and rarity of the assets.

Vulnerability Details

The searchForEgg() function allows any user to attempt to find and mint an egg NFT during an active game session. The only gating mechanism is a configurable probability (eggFindThreshold), which defaults to 20%. However, the function can be called repeatedly in a tight loop by the same user without restriction.

The contract does not:

• Enforce any rate-limiting per user.

• Set a maximum number of eggs that can be minted globally or per session.

• Implement cooldowns, costs, or anti-bot protections.

By setting the eggFindThreshold to 100% and spamming calls to searchForEgg(), an attacker can reliably mint unlimited eggs.

PoC

Output

This demonstrates that the user was able to mint 50 NFTs in a single transaction sequence, confirming the contract’s vulnerability to rapid inflation.

Impact

• NFT Supply Inflation: Unlimited egg minting undermines the intended rarity of NFTs.

• Economic Exploitation: Attackers can flood the vault or secondary markets with eggs.

• Loss of Trust: If users perceive the game as abusable or unfair, they may stop participating.

• System Abuse: Bots or scripts can repeatedly call the function to mint thousands of NFTs.

Tools Used

Foundry

Recommendations

To address the issue, consider implementing one or more of the following:

1. Mint Cap per Player: Limit how many eggs each address can mint per game session.

2. Global Supply Cap: Set a hard cap on the total number of eggs that can exist.

3. Cooldown Periods: Enforce a delay (e.g. 30 seconds) between searchForEgg() calls per user.

4. Dynamic Difficulty: Reduce eggFindThreshold as more eggs are minted, to slow inflation.

5. Require Payment or Staking: Make users pay a small fee or stake tokens to search, deterring spam.