First Flight #5: Santa's List

Summary

Initializers must be protected

Vulnerability Details

Location: Function modifier SantasList.onlySanta() (src/SantasList.sol#99-104) is an unprotected initializer. The modifier restricts certain functions to be callable only by the Santa address.

Impact

Access Control: The checkList and checkTwice functions are intended to be called only by Santa (the owner). The contract uses a custom onlySanta modifier for this purpose. It's crucial that the i_santa address is securely managed to prevent unauthorized access.

Tools Used

Audit Wizard (Slither)

Recommendations

Protect initializers with modifiers/require statements