checkList function can be called by anyone
Summary
The function checkList should be only callable by Santa as mentioned in the documentation.
But anyone can call the function.
Vulnerability Details
The function checkList is not protected and anyone can call this function as it is an external function. There is no verification on which address calls it.
The documentation clearly indicates that this function should only be callable by Santa
Impact
As anyone can call the checkList function, it can be possible to change the status of any address at any time.
Someone could for example decide to change the status of all nice or extra nice adresses which would prevent them to collect presents
Tools Used
Manual
Recommendations
Add onlySanta as a modifier of the function :
function checkList(address person, Status status) external onlySanta {
Lead Judging Commences
Access Control on checkList()
Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.