All users are initialized as `NICE` without being checked and can collect presents
Summary
User statuses are defined in an enum SantasList::Status where the first value is set as NICE which means all users are initialized as NICE by default.
Vulnerability Details
Solidity enums are actually just uints which start from 0 so the NICE status is equal to 0. The mappings tracking s_theListCheckedOnce and s_theListCheckedTwice map user addressed to Status. All mapping values that have not been written to default to 0 therefore all users are automatically NICE by default for both mappings.
Impact
Anyone can claim NFTs
Tools Used
Manual Review
Recommendations
Consider adding a status 'UNKNOWN' make it the first status in the enum declaration which would make all users 'UNKNOWN' by default.
Lead Judging Commences
default status is nice
In Solidity the first element of an enum is the default value. In Santa's List, the means each person is mapped by default to 'NICE'.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.