Summary

The contract owner can change the gameContract address at any time, including during an active game, without any validation. This can break in-progress gameplay interactions, such as minting found eggs.

Vulnerability Details

The setGameContract() function lacks a check to ensure the game is not currently active (gameActive). If changed mid-game, any players relying on the previous game contract logic may encounter errors or failed operations.

For example, users might find eggs through gameplay, but the minting or reward logic may no longer function if it's tied to the old contract address.

Impact

Loss of Progress - Players may lose their ability to mint eggs if the contract is changed during gameplay.

Tools Used

Manual review

Recommendations

Add requirement for gameActive variable