Submission Details
Severity:
Delete depositor in withdrawEgg() __ EggVault.sol
Summary
The withdrawEgg function clears the depositor before calling transferFrom.
/// @notice Allows the depositor to withdraw their egg from the vault.
function withdrawEgg(uint256 tokenId) public {
require(storedEggs[tokenId], "Egg not in vault");
require(eggDepositors[tokenId] == msg.sender, "Not the original depositor");
storedEggs[tokenId] = false;
delete eggDepositors[tokenId];
eggNFT.transferFrom(address(this), msg.sender, tokenId);
emit EggWithdrawn(msg.sender, tokenId);
}
Vulnerability Details
In the current implementation, the contract deletes the eggDepositors[tokenId]) **before **calling the external eggNFT.transferFrom(). This could lead to a state where the egg is not transferred but the tracking is already deleted.
Impact
User can't withdraw their egg from the vault.
Tools Used
Manual review
Recommendations
Delete after calling transferFrom.
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.