First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

SantaToken:burn() does not burn the correct amount of SANTA token

dougo

Summary

SantaToken:burn() does not burn the correct amount of SANTA token

Vulnerability Details

The SantaToken:burn() function burns a hard-coded amount of 1e18 SANTA token each time it is called. SantaToken:burn() is called by SantasList:buyPresent() and the documented cost of gifting a present is 2e18 SANTA. This vulnerability results in leaving "gifters" with more SANTA token than they should have.

Impact

High

PoC

The following Foundry test will fail with current code as the user will be left with 1e18 SANTA instead of 0 SANTA which is expected...

function testBuyPresentWithTwoSANTA() public {
deal(address(santaToken), user, 2e18);
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
santaToken.approve(address(santasList), 2e18);
santasList.buyPresent(user);
vm.stopPrank();
​
assertEq(santasList.balanceOf(user), 1);
// expect santaToken balance to be 0 since NFT gift price is 2e18
assertEq(santaToken.balanceOf(user), 0);
}

Tools Used

Visual Studio Code, Foundry

Recommendations

Change the SantaToken:burn() function as show below to take a parameter for the amount of SANTA token to be burned...

function burn(address from, uint256 amount) external {
if (msg.sender != i_santasList) {
revert SantaToken__NotSantasList();
}
_burn(from, amount);
}

Change the call to burn() from SantasList:buyPresent() to pass an amount...

uint256 private constant c_nftGiftCost = 2e18;
​
function buyPresent(address presentReceiver) external onlyNiceOrExtraNice {
i_santaToken.burn(presentReceiver, c_nftGiftCost);
_mintAndIncrement();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Price is not enforced in buyPresent

This line indicates that the intended cost of presents for naughty people should be 2e18: https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L87 PURCHASE_PRESENT_COST should be implemented to enforce the cost of presents.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.