Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can steal EggNFTs by frontrunning `EggVault:depositEgg()`

0xlrivo

Description

As we can see depositEgg requires the NFT to be sent in advance to the vault and then call such function to register the deposit:

function depositEgg(uint256 tokenId, address depositor) public {
require(eggNFT.ownerOf(tokenId) == address(this), "NFT not transferred to vault");
require(!storedEggs[tokenId], "Egg already deposited");
storedEggs[tokenId] = true;
eggDepositors[tokenId] = depositor;
emit EggDeposited(depositor, tokenId);
}

An attacker can simply scan the mempool for a EggNFT transfer to the vault and simply frontrun the depositEgg() transaction of the NFT's owner by setting himself as the depositor... effectively stealing the NFT.

Tools Used

  • Manual review

Recommendation

Restrict depositEgg() to be only callable by the associated EggHuntGame which will transfer the NFT and deposit it into the vault in a single transaction making it impossible to frontrun it.

Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Frontrunning Vulnerability DepositEgg

Front-running depositEgg allows deposit ownership hijacking.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.