Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: high
Valid

Everyonce can set status for different users

Summary

The checkList has no OnlySanta Modifier and thus everyone can set random status for random user

Vulnerability Details

If someone is set to Extra Nice or Nice, a malicious actor can set the user back to Naughty and user receives no NFT

POC

function test_changeChecklistStatus() public {
// set user to status nice
testCheckList();
// everyone can change status
vm.prank(malicious);
santasList.checkList(user, SantasList.Status.NAUGHTY);
assertEq(uint256(santasList.getNaughtyOrNiceOnce(user)), uint256(SantasList.Status.NAUGHTY));
}

Impact

Nice or Extra Nice users lost possibility to mint NFTs

Tools Used

Foundry / Manual Review

Recommendations

Add onlySanta modifier to function

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.