Submission Details
Severity:
Unrestricted Access in `checkList` Function
Vulnerability Details
The checkList function, intended for exclusive access by Santa, lacks necessary access controls.
/*
* @notice Do a first pass on someone if they are naughty or nice.
* Only callable by santa //@audit no access control
*
* @param person The person to check
* @param status The status of the person
*/
function checkList(address person, Status status) external {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Impact
Unauthorized Access: Any user can call the function and modifying data meant to be modified only by Santa.
Data Integrity Risk: The lack of access control jeopardizes the integrity of
s_theListCheckedOnce.
Recommendations
Implement Access Control: Introduce a modifier to restrict function access to Santa.
Updates
Lead Judging Commences
inallhonesty about 2 years ago
Submission Judgement Published Assigned finding tags:
Access Control on checkList()
Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.