Submission Details
Severity:
Lack of Reentrancy Protection in withdrawEgg
Summar
A malicious contract could exploit a reentrancy vulnerability during NFT withdrawals.
Vulnerability Details
The function performs the external call (NFT transfer) before clearing internal state:
function withdrawEgg(uint256 tokenId) public {
require(storedEggs[tokenId], "Egg not in vault");
require(eggDepositors[tokenId] == msg.sender, "Not the original depositor");
storedEggs[tokenId] = false;
delete eggDepositors[tokenId];
eggNFT.transferFrom(address(this), msg.sender, tokenId); // external call
emit EggWithdrawn(msg.sender, tokenId);
}
If
msg.senderis a contract, it could re-enterwithdrawEggvia a fallback/receiver hook before the state is fully cleared.
Impact
Could allow multiple withdrawals of the same NFT or manipulation of internal state in an unsafe manner.
Tools Used
Manual review
Recommendations
Use OpenZeppelin's
ReentrancyGuard.Also consider state changes before external calls as an added safeguard
Rewards breakdown
nSLOC
129This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.