Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

User could lost his nft, after change nft address in vault contract

sovaslava

Summary

If vault owner change address of nft contract, users could not withdraw them from vault. Also new user's coult not deposit nft to vault if nft with the same id already deposited previously(old nft contract)

Vulnerability Details

As we can see, address of nft contract sets not in construnction ,but in function setEggNFT. So owner could change nft address at any time.

Function withdrawEgg in vault uses current value of nft contact, which stored in eggNFT value.

function withdrawEgg(uint256 tokenId) public {
...
eggNFT.transferFrom(address(this), msg.sender, tokenId);
emit EggWithdrawn(msg.sender, tokenId);
}

if owner has change contract address, they could not receive his nft. because vault call new nft contract. And vault do not has new nft on his balance.

Impact

  1. User could not withdraw his nft from vault.

  2. Users of new nft contact could deposit their nft, if the same id already has been deposited.

Tools Used

Manual review

Recommendations

Store nft address contract when user deposit nft in the vault.

Updates

Lead Judging Commences

m3dython Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

State corruption

Changing the NFT contract address doesn't update the storedEggs and eggDepositors mappings

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.