Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Uninitialized gameContract in EggstravaganzaNFT contract

lazyrams

Summary

The EggstravaganzaNFT contract’s gameContract address is not initialized during deployment, risking a total failure of NFT minting functionality.

Vulnerability Details

Location: EggstravaganzaNFT.sol
Code Snippet:

constructor(string memory _name, string memory _symbol)
ERC721(_name, _symbol) Ownable(msg.sender)
{} // 🚨 No `gameContract` initialization
​
function setGameContract(address _gameContract) external onlyOwner {
gameContract = _gameContract; // Owner must call this post-deployment
}
​
function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter"); // Reverts if `gameContract` is unset
}

Issue:

  • Missing Constructor Initialization: The gameContract address is not set during deployment.

  • Critical Dependency: The EggHuntGame contract cannot mint NFTs unless the owner manually calls setGameContract().

Attack Scenario:

  1. Owner deploys EggstravaganzaNFT but forgets to call setGameContract().

  2. Players attempt to mint NFTs via EggHuntGame, but all calls to mintEgg() revert.

  3. The game becomes non-functional, and NFTs cannot be distributed.

Impact

  • Game Deadlock: The entire egg hunt game cannot proceed without NFT minting.

  • User Frustration: Players cannot participate, leading to loss of engagement.

Tools Used

  • Manual Code Review

Recommendations

1. Initialize gameContract in Constructor (Recommended):

constructor(
string memory _name,
string memory _symbol,
address _gameContract // Add parameter
) ERC721(_name, _symbol) Ownable(msg.sender) {
require(_gameContract != address(0), "Invalid game contract");
gameContract = _gameContract;
}

2. Add Redundant Check in mintEgg() (Defense-in-Depth):

function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(gameContract != address(0), "Game contract not set"); // Additional check
require(msg.sender == gameContract, "Unauthorized minter");
// ... rest of logic ...
}
Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

State corruption

Changing the NFT contract address doesn't update the storedEggs and eggDepositors mappings

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.