First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`firstCheck` by santa can be bypassed

0xaraj

Summary

First check for a person to add in second checkList by santa can be bypassed because of default value of ENUM

Vulnerability Details

For a person to be added in s_theListCheckedTwice mapping, that person should be first in s_theListCheckedOnce mapping, but if santa passes an address that is not in s_theListCheckedOnce with NICE status in SantasList::checkTwice then it will pass the check because s_theListCheckedOnce mapping will give default value of ENUM which is 0(in our case) which is NICE by default

//Here is the POC, we are calling directly checkTwice without calling checkList first

function test_CheckListFirstCanBeByPassed() public {
//here we are calling directly checkTwice without calling checkList
vm.startPrank(santa);
santasList.checkTwice(user, SantasList.Status.NICE);
vm.stopPrank();
​
assertEq(uint256(santasList.getNaughtyOrNiceOnce(user)), uint256(SantasList.Status.NICE));
assertEq(uint256(santasList.getNaughtyOrNiceTwice(user)), uint256(SantasList.Status.NICE));
}

Impact

Wrong person can be set in s_theListCheckedTwice and that person can mint token

Tools Used

  • Manual review

Recommendations

There are some ideas protocol can do

  • Make a false status at 0(default) position like

enum Status {
//even if someone passed the check they will not be able to `collectPresent` because only NICE OR EXTRA_NICE can collect
@> FALSE_STATUS,
NICE,
EXTRA_NICE,
NAUGHTY,
NOT_CHECKED_TWICE
}

  • Adjust NAUGHTY OR NOT_CHECKED_TWICE above, even if someone passed the check they will not be able to collectPresent because only NICE OR EXTRA_NICE people can collect

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

default status is nice

In Solidity the first element of an enum is the default value. In Santa's List, the means each person is mapped by default to 'NICE'.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.