First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

SantasList__DoubleCollect

darkart

Summary

A critical vulnerability has been discovered in the collectPresent() function of the SantasList.sol smart contract that could allow an attacker to reclaim their presents multiple times. This vulnerability is caused by the function not tracking whether the user has previously collected a present. This vulnerability could be exploited to mint an unlimited number of Santa tokens.

Vulnerability Details

An attacker could exploit this vulnerability by sending or burning their NFT and then calling the collectPresent() function again. This would allow the attacker to mint a new NFT, even though they had already collected a present.

Impact

This vulnerability could allow an attacker to:

**Mint an unlimited number of Santa tokens

**Disrupt the operation of the protocol

**Take control of affected systems

Tools Used

Manual Review

Recommendations

Modify the collectPresent() function to store a flag indicating whether the user has already collected a present

Example of how it can be integrated :

First, we need to create the variable :

byte8 bool s_alreadyCollected;

Then we ned to modify collectPressent()

function collectPresent() external {
if (block.timestamp < CHRISTMAS_2023_BLOCK_TIME) {
revert SantasList__NotChristmasYet();
}
if (balanceOf(msg.sender) > 0) {
revert SantasList__AlreadyCollected();
}
if (s_theListCheckedOnce[msg.sender] == Status.NICE && s_theListCheckedTwice[msg.sender] == Status.NICE) {
if (s_alreadyCollected[msg.sender]) {
revert SantasList__AlreadyCollected();
}
_mintAndIncrement();
s_alreadyCollected[msg.sender] = true;
return;
} else if (
s_theListCheckedOnce[msg.sender] == Status.EXTRA_NICE
&& s_theListCheckedTwice[msg.sender] == Status.EXTRA_NICE
) {
if (s_alreadyCollected[msg.sender]) {
revert SantasList__AlreadyCollected();
}
_mintAndIncrement();
i_santaToken.mint(msg.sender);
s_alreadyCollected[msg.sender] = true;
return;
}
revert SantasList__NotNice();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Weak Already Collected Check

Relying on balanceOf > 0 in collectPresent() allows the msg.sender to send their present to another address and then collect again.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.