Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: high
Valid

`SantasList::checkList` is missing modifier

Summary

The function checkList is missing modifier onlySanta. This is required because this function can only by called by santa. We can see that in checkTwice function.

Impact

Anyone can call checkList

Tools Used

Manual Review, Foundry

Proof of Concept

Changed the test file to this:

function testCheckList() public {
- vm.prank(santa);
+ vm.prank(user);
santasList.checkList(user, SantasList.Status.NICE);
assertEq(uint256(santasList.getNaughtyOrNiceOnce(user)), uint256(SantasList.Status.NICE));
}

Test passes:

[PASS] testCheckList() (gas: 16069)

Recommendations

Add onlySanta modifier

function checkList(address person, Status status) external onlySanta {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.