First Flight #5: Santa's List

Summary

SantaToken.sol is a centralized smart contract as the 'i_santasList' address has privileges.

Vulnerability Details

'i_santasList' is able to mint as many tokens as they want for the chosen address, as well as burning the desired amount of tokens from any address.

Impact

Impact can be really high as the token supply can be totally modified. Users could also lose their funds if 'i_santasList' burns their tokens.

Tools Used

Recommendations

The suggestion for these cases would be decentralizing the smart contract by deleting the privileges from 'i_santasList'. This way, the mint and burn function would be carried out by a consensus of many users of the token. It is understandable that the contract is centralized on purpose, but in that case it is mandatory to make sure that 'i_santasList' is realiable, responsible and never corruptable so that users' balances will never be affected.