checkList Modifier
Summary
checkList() is missing the onlySanta modifier
Vulnerability Details
Anyone can call the first checkList and set the status to any value for any address, s_theListCheckedOnce mapping.
Impact
Attacker can reset the status of all participants before the cutoff block and no one would get presents since the NICE status need to be equivalent in both s_theListCheckedOnce and s_theListCheckedTwice.
Tools Used
Remix/Foundry
Recommendations
Apply onlySanta modifier to checkList function.
Lead Judging Commences
Access Control on checkList()
Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.