First Flight #5: Santa's List

Summary

Using balanceOf[msg.sender] in collectPresent may allow user to collect multiple NFT's

Vulnerability Details

The collectPresent function checks if the balance of NFTs of a user is greater than 0 to prevent multiple collections. This check might not work properly if the user transfers their initially collected NFT to another address and tries to collect again.

Impact

Users can to mint NFT's indefinitely

Tools Used

Foundry

Recommendations

Use a mapping to track how many presents each user has collected and check the mapping instead of the user balance in collectPresent function.
mapping(address person => int collectedPresents) private s_userCollectedPresents;