Submission Details
Severity:
Lack of access control in `checkList` function
Summary
Lack of access control in checkList function.
Vulnerability Details
Lack of access control can cause manipulating status.
function checkList(address person, Status status) external {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
This function should be callable only by santa.
Impact
Scenario:
Attacker can change his own status to nice and he will be rewarded with present.
Tools Used
Manual Review
Recommendations
-function checkList(address person, Status status) external {
+function checkList(address person, Status status) external onlySanta {
Updates
Lead Judging Commences
inallhonesty about 2 years ago
Submission Judgement Published Assigned finding tags:
Access Control on checkList()
Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.