Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Uninitialized gameContract in EggstravaganzaNFT contract

lazyrams

Summary

The EggstravaganzaNFT contract’s gameContract address is not initialized during deployment, risking a total failure of NFT minting functionality.

Vulnerability Details

Location: EggstravaganzaNFT.sol
Code Snippet:

constructor(string memory _name, string memory _symbol)
ERC721(_name, _symbol) Ownable(msg.sender)
{} // 🚨 No `gameContract` initialization
​
function setGameContract(address _gameContract) external onlyOwner {
gameContract = _gameContract; // Owner must call this post-deployment
}
​
function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(msg.sender == gameContract, "Unauthorized minter"); // Reverts if `gameContract` is unset
}

Issue:

  • Missing Constructor Initialization: The gameContract address is not set during deployment.

  • Critical Dependency: The EggHuntGame contract cannot mint NFTs unless the owner manually calls setGameContract().

Attack Scenario:

  1. Owner deploys EggstravaganzaNFT but forgets to call setGameContract().

  2. Players attempt to mint NFTs via EggHuntGame, but all calls to mintEgg() revert.

  3. The game becomes non-functional, and NFTs cannot be distributed.

Impact

  • Game Deadlock: The entire egg hunt game cannot proceed without NFT minting.

  • User Frustration: Players cannot participate, leading to loss of engagement.

Tools Used

  • Manual Code Review

Recommendations

1. Initialize gameContract in Constructor (Recommended):

constructor(
string memory _name,
string memory _symbol,
address _gameContract // Add parameter
) ERC721(_name, _symbol) Ownable(msg.sender) {
require(_gameContract != address(0), "Invalid game contract");
gameContract = _gameContract;
}

2. Add Redundant Check in mintEgg() (Defense-in-Depth):

function mintEgg(address to, uint256 tokenId) external returns (bool) {
require(gameContract != address(0), "Game contract not set"); // Additional check
require(msg.sender == gameContract, "Unauthorized minter");
// ... rest of logic ...
}
Updates

Lead Judging Commences

m3dython Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

State corruption

Changing the NFT contract address doesn't update the storedEggs and eggDepositors mappings

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!