[Crash] Unchecked msg.eggAmount numeric operation in addEggs handler

[coderabbitai]

Summary

Services server produces NaN when msg.eggAmount is undefined, corrupting user balance.

Affected Code

server-services/start-services.js:378

userData.currentBalance += (msg.eggAmount * eggMultiplier); // NaN if msg.eggAmount undefined

Vulnerability

If client sends {"cmd":"addEggs"} without eggAmount field, balance becomes NaN.

Impact

• User balance corruption
• Database integrity issue
• Potential crashes on subsequent balance operations

Proof of Concept

{"cmd":"addEggs","session":"valid_session"}

Result: userData.currentBalance = NaN

Recommended Fix

const eggAmount = parseInt(msg.eggAmount) || 0;
if (eggAmount > 0 && eggAmount < 10000) { // Add reasonable bounds
  userData.currentBalance += (eggAmount * eggMultiplier);
}

References

• PR: New Blocks & Ported fancyMuzzle flash #43