First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

SantasList__UnrestrictedStatusChange

darkart

Summary

In the checkList() function of the Santa's List smart contract it could allow anyone to drain the contract of Santa tokens. This vulnerability is caused by the function lacking access control, allowing anyone to call it and give themselves an EXTRA_NICE status, which grants them the ability to collect a large number of tokens.

Vulnerability Details

The checkList() function in the Santa's List smart contract does not implement any access control measures, allowing anyone to call it and assign themselves an EXTRA_NICE status. This status grants users the ability to collect a large number of Santa tokens by repeatedly calling the collectPresent() function. As a result, anyone can exploit this vulnerability to drain the contract of Santa tokens.

Impact

An attacker could exploit this vulnerability to repeatedly call the collectPresent() function with the EXTRA_NICE status, draining the contract of Santa tokens. This could lead to a severe depletion of the contract's resources and disrupt the protocol's economy.

Tools Used

Manual Review

Recommendations

Implement an onlySanta modifier to restrict the ability to call the checkList() function.

function checkList(address person, Status status) external onlySanta {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.