First Flight #5: Santa's List

Summary

The current approach to user verification on Santa's list involves manual checks for each user, doubling the verification process, which makes the process almost impossible

Vulnerability Details

The current method of double-checking user statuses for eligibility involves resource-intensive manual verifications, which could become impractical at scale.

Impact

Scalability issues might arise due to the resource-intensive nature of the manual verification process, particularly with a growing user base. Lets look at a quick POC.

Bob who is always up to speed with new staff gets the information about Santa and his presents.

Bob posts to social media, keep in mind Bob has a very big audience and now everyone now knows about the Santa presents.

every Bob follower posts the same news and now the information gets to 1 million people.

This means that since Santa is the only one who can verify the people he will have to do this 2 million times because the check is done twice by only him.

That wont happen and the contract will almost be unusable in this case.

Tools Used

Manual analysis

Recommendations

At first I was thinking maybe Santa can do the first check in the checklist then after that he can assign all the nice or say extra nice users to help him perform the checkTwice function putting in mind that all the necessary measures to ensure that status match and nice users won't try to update themselves to extra nice but still we are talking about 1 million users, maybe the best option would be to make users of automated keepers to help with the checks