First Flight #5: Santa's List

Summary

Function checkList expected to be called only by Santa. However no caller checks are there

Vulnerability Details

Contract logic considers person status to be approved if it's double confirmed by checkList and checkTwice with the same status.
However as function checkList can be called by anyone, Santa's checkTwice transaction can be front-runned with checkList transaction by attacker. This transaction sets first check status the same as the second check status if second check status is better than first set

Impact

If second check if attacker has a mistake, this mistake will be applied regardless the first check

Tools Used

Recommendations

Add modifier onlySanta to the function checkList