First Flight #5: Santa's List

Beginner FriendlyFoundry
100 EXP
Submission Details
Severity: high
Valid

`SantasList:: checkList` lack of access control, anybody can call it to get desired status. Using of this list by santa will get unfair advantage to the caller to get nft and token.

Updates

Lead Judging Commences

InAllHonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can’t find an answer? Join our Discord or follow us on Twitter.