First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

testCheckList() can be called by each for each

wallebach

Summary

Anyone can call testCheckList() function. This may affect gift allocation decisions.

Vulnerability Details

According to the description of how the contract functions, the `testCheckList()' function can only be called by Santa. In reality, however, the function can be called by anyone. It is declared as external. It does not contain an access modifier, nor does it check that the code is actually called by Santa. In addition, anybody can set the status to anybody else. See the example below:

function testCheckListByUser() public {
// The specific roles are not really important in this particular test.
// The idea is to show: Anyone can set a status for anyone.
vm.prank(user);
// User sets status for himself
santasList.checkList(user, SantasList.Status.NICE);
assertEq(uint256(santasList.getNaughtyOrNiceOnce(user)), uint256(SantasList.Status.NICE));
vm.stopPrank();
​
vm.prank(santa);
// Santa sets status for user
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
assertEq(uint256(santasList.getNaughtyOrNiceOnce(user)), uint256(SantasList.Status.EXTRA_NICE));
vm.stopPrank();
​
vm.prank(attacker);
// Attacker sets status for Santa
santasList.checkList(santa, SantasList.Status.NAUGHTY);
assertEq(uint256(santasList.getNaughtyOrNiceOnce(santa)), uint256(SantasList.Status.NAUGHTY));
vm.stopPrank();
}

Impact

High. Anyone can set the status they want. The legitimate status set by Santa can be overwritten.

Tools Used

Manual check.

Recommendations

Apply onlySanta() modifier.

Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Out of scope
wallebach Submitter
almost 2 years ago
wallebach Submitter
almost 2 years ago
inallhonesty Lead Judge
almost 2 years ago
wallebach Submitter
almost 2 years ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.