Submission Details
Severity:
Missing modifier in check in the checkList function
Summary
s_theCheckListOnce is a state variable that should only be updated by santa himself but due to missing modifier, any user or attacker can call the function and update the state. Attacker/user can then proceed to collect present
Vulnerability Details
Access control
Impact
Missing modifier allows set their s_theCheckListOnce status buy themselves and claim present
Tools Used
foundry, manual review
Recommendations
should add the onlysanta modfier
Updates
Lead Judging Commences
inallhonesty almost 2 years ago
Submission Judgement Published Assigned finding tags:
Access Control on checkList()
Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.