Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing Time Check Allows Premature Game Termination in `EggHuntGame` contract.

SashaFlores

Summary

The endGame function in the EggHuntGame contract allows the game owner to end the egg hunt at any time while the game is active, which can cause unexpected behavior that affect multiple users, even if they don’t result in a direct loss of funds.

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-04-eggstravaganza/blob/main/src/EggHuntGame.sol#L51

Tools Used

  • Manual and Visual Code Inspection.

  • Forge Test

Proof of Concept

Test the endGame function to end earlier than endTime:

function test_EndGameBeforeEndTime() public {
uint256 current = block.timestamp;
​
game.startGame(300);
console.log("Game started at:", current);
console.log("Game endTime:", game.endTime());
​
​
// Check that the game is active and times are set.
assertTrue(game.gameActive());
assertEq(game.startTime(), current);
assertEq(game.endTime(), current + 300);
​
// Verify game status while active.
string memory status = game.getGameStatus();
assertEq(status, "Game is active");
​
// Manipulate time to pass but not reach endTime
vm.warp(100);
​
// End the game.
game.endGame();
assertFalse(game.gameActive());
​
status = game.getGameStatus();
assertEq(status, "Game is not active");
​
​
​
// Assert that the game was ended prematurely
assertFalse(game.gameActive());
console.log("Game ended at:", block.timestamp);
if (block.timestamp < game.endTime()) {
console.log("Game ended before endTime");
}
}

The test passes and owner succeeded in ending the game prematurely

[PASS] test_EndGameBeforeEndTime() (gas: 86361)
Logs:
Game started at: 1
Game endTime: 301
Game ended at: 100
Game ended before endTime

Impact

This vulnerability enables the owner to prematurely terminate the game, which can:

  • Prevent players from continuing to find eggs within the expected timeframe.

  • Disrupt gameplay and reduce fairness for participants.

  • Violate trust assumptions about game integrity.

  • Potentially result in fewer NFTs being minted or collected than players anticipated.

While no funds are at risk, the fairness and core logic of the NFT-based game are significantly compromised.

Recommendations

Update the endGame function to enforce that the current block timestamp has reached or passed the declared endTime:

function endGame() external onlyOwner {
require(gameActive, "Game not active");
require(block.timestamp >= endTime, "Game not yet finished");
gameActive = false;
emit GameEnded(block.timestamp);
}
Updates

Lead Judging Commences

m3dython Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Trusted Owner

Owner is trusted and is not expected to interact in ways that would compromise security

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.