Submission Details
Severity:
Santa can collect the presents for himself
Summary
Santa can call the collectPresent() function.
Vulnerability Details
Since the logic of the contract assumes that only NICE and EXTRA NICE people can collect presents, and Santa is not part of any lists, this can be seen as an access issue.
See the test below:
function testCollectPresentBySanta() public {
// Santa sets status for himself
vm.startPrank(santa);
santasList.checkList(santa, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(santa, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
// Setting the time after Christmas
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
// Santa successfully gets his present
vm.prank(santa);
santasList.collectPresent();
assertEq(santasList.balanceOf(santa), 1);
}
Impact
Low. Although an access check is missing, this is not a security problem.
Tools Used
Manual check.
Recommendations
Check if msg.sender is Santa. For example:
error SantasList__SantaNotAllowed();
...
if (msg.sender != i_santa) {
revert SantasList__SantaNotAllowed();
}
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.