First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Default to NICE

f3d0ss

Vulnerability Details

Status.NICE has value 0, this means that every address in the mappings s_theListCheckedOnce and s_theListCheckedTwice has default value to Status.NICE and can therefor claim the gift if not explicitly set to another Status.
The following is an example of test that should not pass:

function testCanClaimGiftByDefault() public {
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
vm.prank(user);
santasList.collectPresent();
}

Impact

An attacker can generate an "infinite" amount of address and claim an "infinite" amount of gift.

Recommendations

Change the Status enum to reflect the value in the README with UNKNOWN as a default value:

enum Status {
UNKNOWN,
NICE,
EXTRA_NICE,
NAUGHTY
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

default status is nice

In Solidity the first element of an enum is the default value. In Santa's List, the means each person is mapped by default to 'NICE'.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.