First Flight #5: Santa's List

Summary

The check for SantaList__AlreadyCollected is insufficient.

Vulnerability Details

Any user who can claim the NFT can transfer it to another address and claim it again infinitely.

Impact

Infinite NFTs can be minted by anyone with status NICE or EXTRA_NICE.

Tools Used

N/A

Recommendations

Make the present NFT soulbound

OR

Maintain a mapping of addresses that have collected a present and check it before minting

OR

Add a CLAIMED status to enum Status.
Update s_theListCheckedOnce and s_theListCheckedTwice upon mint.