First Flight #5: Santa's List

Summary

With the status type set to NICE at position 0 - the default value for any address, it implies that any user can be in the NICE status without having to go through Santa's check functions.

Vulnerability Details

Impact

Any user can call the collectPresent() function with the status type set to NICE to mint 1 NFT token.

Test

function testDefaultType() public {
    assertEq(uint256(santasList.getNaughtyOrNiceOnce(user)), uint256(SantasList.Status.NICE));
    vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
    vm.prank(user);
    santasList.collectPresent();
    vm.stopPrank();
    assertEq(santasList.balanceOf(user), 1);
}