First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

NFT presents are bought at discount price

wafflemakr

Summary

NFT presents are bought at discount price

Vulnerability Details

SantasList::buyPresent is a function that allows any user to burn SantaTokens and mint NFT presents to a receiver address. The cost of the present should be 2 SANTA, represented in the constant PURCHASED_PRESENT_COST. But, this constant is not used in the calculations. Instead, a fixed value of 1e18 is used in the SantaToken::burn function. This will make the cost of buying the NFT present to by 1 SANTA instead of 2, a 50% discount in price.

PoC

function testBuyPresentAtDiscount() public {
// initial bal
deal(address(santaToken), user, 10e18);
​
// buy present
vm.startPrank(user);
santaToken.approve(address(santasList), 1e18);
santasList.buyPresent(user);
vm.stopPrank();
​
// check
assertEq(santasList.balanceOf(user), 1);
assertEq(santaToken.balanceOf(user), 9e18);
}

Output:

forge test --mt testBuyPresentAtDiscount -vv
[⠒] Compiling...
No files changed, compilation skipped
​
Running 1 test for test/unit/SantasListTest.t.sol:SantasListTest
[PASS] testBuyPresentAtDiscount() (gas: 247988)
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.14ms

Impact

HIGH, discounted present price.

Tools Used

  • Manual Review

  • Foundry

Recommendations

Either move the constant variable to the SantaToken contract, so it burns 2e18 tokens instead of 1e18, or pass a parameter amount to the SantaToken::burn so it knows how many tokens to burn.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Price is not enforced in buyPresent

This line indicates that the intended cost of presents for naughty people should be 2e18: https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L87 PURCHASE_PRESENT_COST should be implemented to enforce the cost of presents.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.