A user could collect the NFT several times
Summary
Same address could collect several times the NFT and get several SantaToken
Vulnerability Details
Function collectPresent check if an address has already collected the NFT using the following line :
Anyway, if the caller, after calling collectPresent, transfer the NFT to another adresses he owns, the value of balanceOf(msg.sender)is 0 and then the function does not revert.
Impact
Exploiting this vulnerability, a NICE user could then call collectPresent, transfer the NFT, and collect again until there is no more NFT to retrieve.
A EXTRA_NICE user could in addition collect all the SantaToken.
Tools Used
Manual
Recommendations
It would be safer to store the adresses that have collected the NFT using a mapping, and use this mapping to check instead of the balance.
Lead Judging Commences
Weak Already Collected Check
Relying on balanceOf > 0 in collectPresent() allows the msg.sender to send their present to another address and then collect again.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.