Attacker can Prevent user from collecting present
Summary
Attacker can prevent user from collecting by sending nft to the users address. This happens because the collectPresent track if a user has claimed his/her present by checking the number of nft in thier wallet. If the nft balance of user is greater than zero the function will revert. Attacker can take advantage of this by sending user one nft.
Vulnerability Details
DOS
Impact
user wont be able to collect present
Tools Used
foundry
Recommendations
present collected should be tracked with a separate state(enum) instead.
Lead Judging Commences
Weak Already Collected Check
Relying on balanceOf > 0 in collectPresent() allows the msg.sender to send their present to another address and then collect again.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.