H1: Any address can collect the present at default
Summary
The default value of an "Enum" is the first value listed (on index "0"), which in this case is Status: "NICE". This value is then used as a default value in both mappings: "s_theListCheckedOnce" and "s_theListCheckedTwice". Any address can therefore mint and receive the NFT
Vulnerability Details
The Status enum is written in a way, that defaults to the value of "NICE". Both mappings are therefore initiated on "NICE" and any address calling "collectPresent" function can receive the NFT as they are by default marked "NICE" in both.
Impact
Any caller can mint their NFT by default unless activelly changed.
Tools Used
Static analysis
Recommendations
Change the enum Status order of values, making the first value in the enum "NAUGHTY" or "NOT_CHECKED_TWICE".
Lead Judging Commences
default status is nice
In Solidity the first element of an enum is the default value. In Santa's List, the means each person is mapped by default to 'NICE'.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.