M1: Missing onlySanta modifier on "checkList" function
Summary
The "checkList" function can be called by any address and can change the value for any other address, including their own.
Vulnerability Details
The "checkList" function is missing the "onlySanta" modifier, and allows any sender to change the values in the "s_theListCheckedOnce" mapping.
Impact
High potential of tampering the values for any user, potentially causing inability to collect the presents for users.
Tools Used
Static analysis
Recommendations
Add "onlySanta" modifier to the "checkList" function.
Lead Judging Commences
Access Control on checkList()
Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.