Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Time Check in endGame() Allows Premature Termination of the Game

jumpupjoran

Summary

The endGame() function in the EggHuntGame contract can be called by the owner at any time, without checking whether the game duration has elapsed. This allows the owner to end the game prematurely, potentially disrupting fair gameplay or user expectations.

While it may be intentional to allow administrative control, the lack of a time check means there is no enforcement of the game's advertised rules e.g., “the game lasts 150 seconds.” If there is ever a need to allow early termination, it should be done through a separate function, clearly labeled as such, to avoid misuse or miscommunication.

Vulnerability Details

The current function:

function endGame() external onlyOwner {
require(gameActive, "Game not active");
gameActive = false;
emit GameEnded(block.timestamp);
}

does not check if block.timestamp >= endTime

This violates the assumption that startGame(duration) guarantees a game window of duration seconds.

Impact

  1. Gameplay disruption: Users may be mid-game and suddenly find the game ended with no chance to win.

  2. Confusing user experience: Frontends or players expecting a 150-second window may be misled.

  3. the owner could call the endGame function thinking the duration has already been passed while the game is still going.

Tools Used

manua code review

Recommendations

split the endGame() in to 2 functions, so that the owner clearly knows what he is doing.

function endGame() external onlyOwner {
require(gameActive, "Game not active");
- require(block.timestamp >= endTime, "Game cannot end before duration");
gameActive = false;
}
​
+ function forceEndGameEarly() external onlyOwner {
+ gameActive = false;
+}
Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

Trusted Owner

Owner is trusted and is not expected to interact in ways that would compromise security

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.