checkList whout access check
Summary
Anyone can change the s_theListCheckedOnce calling checkList(address,Status) setting any user's address to NAUGHTY blocking them from retrieving the gift.
Vulnerability Details
function checkList(address person, Status status) can be called by anyone that want to change a person's status.
If an attacker want to prevent a specific user to claim his gift he can call checkList with a status of NAUGHTY.
Impact
Any user can be blocked from claiming his gift.
Recommendations
Add the modifier onlySanta to the checkList function to allow only to Santa to change the list.
Lead Judging Commences
Access Control on checkList()
Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.