First Flight #5: Santa's List

Summary

The buyPresent function needs to incorporate a check to verify whether the presentReceiver address possesses Santa tokens.

Vulnerability Details

This vulnerability is present in line 173 of the santaList.sol contract. As it stands, only children who have previously invoked the collectPresent function and demonstrated exemplary behavior EXTREMELY_NICE are eligible to receive a gift through the buyPresent function.

Impact

If the presentReceiver address lacks a Santa token balance, the function would revert with an overflow/underflow error.

Tools Used

The identified issue was detected through manual review and Invariant Testing.

Recommendations

1. Implement a modifier to check the Santa token balance of the presentReceiver address before allowing the execution of the buyPresent function. This ensures that only eligible children with a sufficient Santa token balance can receive a gift.