Attacker could frontrun deposit nft to vault
Summary
Attacker could frontrun deposit nft in vault and withdraw nft after that on own address.
Vulnerability Details
User could deposit nft in vault directly, without using funciton depositEggToVault() from EggHuntGame.
User transfer nft on vault contract address.
[Frontrun] Attacker look this tx in mempool and send own tx with call depositEgg(user's nft id, attacker.address). Contract store info, that attacker is owner of this nft.
User send his tx to depositEgg function, but tx will revert.
Attacker call withdrawEgg(user's nft id) and receive nft on his address.
Impact
User could lost his nft, if use depositEgg function directly.
Tools Used
Manual review
Recommendations
Add check in EggVault.depositEgg that caller is EggHuntGame contract and do not allow users call deposit function directly.
Lead Judging Commences
Frontrunning Vulnerability DepositEgg
Front-running depositEgg allows deposit ownership hijacking.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.