First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

```SantaList::buyPresent()``` can be bought for 1 SantaToken not for 2

kiteweb3

Summary

The SantaList::buyPresent() function can be callable paying 1 SantaToken not the expected cost of PURCHASED_PRESENT_COST = 2e18 (requirement in the Readme documentation). Consequently, individuals can obtain presents at half the intended cost.

Vulnerability Details

function buyPresent(address presentReceiver) external {
@> i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}
​
function burn(address from) external {
if (msg.sender != i_santasList) {
revert SantaToken__NotSantasList();
}
@> _burn(from, 1e18);
}
​

Impact

//The Present NFT can be buyed for 1 SantaToken not for 2 SantaToken
​
function testBuyPresentForOneSantaToken() public {
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
santaToken.approve(address(santasList), 1e18);
​
//EXTRA_NICE user collects 1 Present and 1 SantaToken
santasList.collectPresent();
​
console.log("User SantaToken balance before", santaToken.balanceOf(user));
console.log("User Present NFT balance before", santasList.balanceOf(user));
​
//EXTRA_NICE buys a Present for 1 SantaToken
santasList.buyPresent(user);
assertEq(santaToken.balanceOf(user), 0);
​
console.log("User SantaToken balance after", santaToken.balanceOf(user));
console.log("User Present NFT balance after", santasList.balanceOf(user));
vm.stopPrank();
}
​
Logs:
User SantaToken balance before 1000000000000000000
User Present NFT balance before 1
User SantaToken balance after 0
User Present NFT balance after 2
​

Tools Used

Manual Review

Recommendations

Add an if statement for checking the SantaToken balanceOf the msg.sender and modify the SantaToken::burn() function.

+ error SantasList__NotEnoughtToken();
​
function buyPresent(address presentReceiver) external {
+ if (i_santaToken.balanceOf(msg.sender) < PURCHASED_PRESENT_COST) {
+ revert SantasList__NotEnoughtToken();
+ }
i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}
​
function burn(address from) external {
if (msg.sender != i_santasList) {
revert SantaToken__NotSantasList();
}
- _burn(from, 1e18);
+ _burn(from, 2e18);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Price is not enforced in buyPresent

This line indicates that the intended cost of presents for naughty people should be 2e18: https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L87 PURCHASE_PRESENT_COST should be implemented to enforce the cost of presents.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.