Submission Details
Severity:
buyPresent duplicate NFT Clarification
Summary
Contract does not prevent an address from claiming duplicate NFTs via buyPresent.
Vulnerability Details
A user can buy as many presents as they want, as long as they have sufficient SantaTokens.
Impact
The collectPresent logic clearly intends a single address to only receive one present.
Currently, buyPresent has no restriction on the number of presents received.
Tools Used
N/A
Recommendations
Discuss internally what is intended.
If an address should be eligible for only a single present, there should be a SantasList__AlreadyCollected check
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.