First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Frontrunning attacks `SantasList#checkTwice()`

musashi

Summary

Anyone can get present from Santa by frontrunning SantasList#checkTwice() transaction.

Vulnerability Details

Anyone can call SantasList#checkList().

First, attacker calls SantasList#checkList() with his address and random status.

Then, attacker can observe the status value when Santa call SantasList#checkTwice() with his address in the mempool and call SantasList#checkList() again with the same status value as Santa with higher gas fee.

Impact

The attacker can mint many NFT tokens without buying them using SantaToken.

Tools Used

Manual review.

Recommendations

Add access control checks for SantasList#checkList() so that only Santa can call this function.

function checkList(address person, Status status) external onlySanta {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.