First Flight #5: Santa's List

Summary

SantasList.sol is centralized as Santa decides if each user gets a present or not.

Vulnerability Details

The modifier onlySanta only allows 'i_santa' to use the checkTwice() function. This function sets if a user has been NAUGHTY, NICE or EXTRA-NICE so they get presents or not when calling the collectPresent() function.

Impact

The impact is considerable as users may stay without a present if Santa wishes so. They could also receive a present because Santa wants that even if they do not deserve it.

Tools Used

Recommendations

The logic for deciding whether a user deserves a present or not should be decentralized in some way (the criteria needs to be carefully thought) unless we consider that Santa is wise and fair enough to decide who deserves a present and who does not.