Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Vault Deposit Spoofing Vulnerability in EggVault::depositEgg()

lazyrams

Summary

The depositEgg() function allows unauthorized users to spoof deposits, enabling theft of NFTs transferred to the vault.

Vulnerability Details

Location: EggVault.sol, depositEgg() function
Code Snippet:

function depositEgg(uint256 tokenId, address depositor) public {
require(eggNFT.ownerOf(tokenId) == address(this), "NFT not transferred to vault");
require(!storedEggs[tokenId], "Egg already deposited");
storedEggs[tokenId] = true;
eggDepositors[tokenId] = depositor; // 🚨 No access control
}

Issue:

  • Public Function: Any address can call depositEgg() and claim ownership of an NFT after it’s transferred to the vault.

  • No Validation: The depositor parameter is user-provided and not tied to the actual NFT sender.

Attack Scenario:

  1. Alice transfers her NFT to the vault via eggNFT.transferFrom(alice, vault, tokenId).

  2. Bob front-runs Alice’s depositEgg transaction and calls depositEgg(tokenId, bob).

  3. The vault records Bob as the depositor. Bob can now call withdrawEgg(tokenId) to steal Alice’s NFT.

Impact

  • NFT Theft: Malicious users can claim ownership of any NFT sent to the vault.

  • Vault Integrity Compromised: The vault’s tracking system becomes untrustworthy.

  • Direct Financial Loss: Legitimate users lose their deposited assets.

Tools Used

  • Manual review.

Recommendations

  • **Restrict depositEgg to Game Contract **

modifier onlyGameContract() {
require(msg.sender == address(eggHuntGame), "Unauthorized");
_;
}
​
function depositEgg(uint256 tokenId, address depositor) external onlyGameContract {
// Logic remains unchanged
}
Updates

Lead Judging Commences

m3dython Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Frontrunning Vulnerability DepositEgg

Front-running depositEgg allows deposit ownership hijacking.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.