First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

CheckList should have onlySanta modifier.

ararara

Summary

checkTwice function does not verify that Santa is the caller.

Vulnerability Details

Anyone can call checkTwice to add themselves to the s_theListCheckedOnce list. and anyone can remove someone else from this list also.

Impact

This bug compromises the integrity of CheckTwice, because anyone can get themselves approved for the first check by calling it on themselves. This reduces it to one check instead of 2.

Tools Used

Manual Review

Recommendations

Just include the onlySanta modifier in the function header.

function checkList(address person, Status status) external onlySanta {...}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.