First Flight #5: Santa's List

Summary

The SantasList.onlySanta() is unprotected and can be called multiple times.

Vulnerability Details

https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L99-L104

modifier onlySanta() {
    if (msg.sender != i_santa) {
        revert SantasList__NotSanta();
    }
    _;
}

Impact

The unprotected initializer usually involves failing to properly secure the contract's initialization function, allowing it to be called more than once.

Tools Used

Manual Code Review

Recommendations

Add the initializer modifier to the initialize() function and include an explicit test that every initialization function in the system can be called once and only once.