Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

NFT Contract’s mintEgg Has No tokenId Uniqueness Check

0x68

📄 Summary

The EggstravaganzaNFT contract exposes a critical vulnerability in its mintEgg function where it fails to verify the uniqueness of the tokenId being minted. This flaw can lead to token ID collisions, potentially causing unintended overwrites, mint failures, or denial of service depending on the underlying ERC721 implementation.

🛠️ Vulnerability Details

Contract:

EggstravaganzaNFT.sol

Function:

function mintEgg(address to, uint256 tokenId) external returns (bool)

Problem:

The contract does not check whether the tokenId has already been minted. ERC721 tokens are required to have unique token IDs. Attempting to mint an already existing tokenId will revert under OpenZeppelin’s ERC721 implementation. However, without an explicit check, there is:

  • No user-friendly error messaging.

  • No pre-check to prevent unnecessary gas usage.

  • Increased risk of logic bugs if mintEgg is called with duplicate tokenId due to faulty eggCounter tracking or replayed external calls.

Code Snippet:

function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
_mint(to, tokenId); // 🔴 No uniqueness check before minting
totalSupply += 1;
return true;
}

💥 Impact

  • Denial of Service (DoS): Reverting transactions if a duplicate tokenId is passed, halting minting operations.

🔧 Tools Used

  • Manual code inspection

  • Solidity best practice checklist (ERC721 minting patterns)

  • OpenZeppelin ERC721 behavior reference

✅ Recommendations

Solution:

Add a check using _exists(tokenId) (provided by OpenZeppelin's ERC721 base contract):

function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter");
require(!_exists(tokenId), "Token ID already exists"); // ✅ Ensure uniqueness
_mint(to, tokenId);
totalSupply += 1;
return true;
}
Updates

Lead Judging Commences

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.