Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Attacker can steal NFT by backrunning Victim's NFT transfer transaction

boi

Vulnerability Details

  • This Vulnerability arises when a user, instead of using EggHuntGame::depositEggToVault directly calls EggVault::depositEgg, to depsoit the NFT into the vault.

  • User will first transfer the NFT to EggVault in first transaction and then directly call depositEgg with its own address in the second transaction, attacker can backrun the first transaction and call depositEgg with its address to set him owner of the NFT and then he can withdraw the NFT by calling EggVault::withdrawEgg.

Impact

  • Attack can steal victim's NFT by backrunning his transfer NFT function

Updates

Lead Judging Commences

m3dython Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Frontrunning Vulnerability DepositEgg

Front-running depositEgg allows deposit ownership hijacking.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.