First Flight #5: Santa's List

Summary

The elves forgot to add the onlySanta modifier to the checkList() function, so anyone can call it and add users to the list. This situation presents several problems:

1. The code should work as expected and this is an onlySanta function and should work as such.

2. The grinch could add enough users to make checkListTwice() unusable via a DoS attack.

Vulnerability Details (PoC)

Let's start by calling the function with an anonymous user:

This is enough for a High Risk vulnerability but let´s create infinite loops to destroy the function and contract:

The contract could be inaccessible (DoS attack) and a malicious actor could add multiple users to the mapping.

Impact

The contract could be inaccessible (DoS attack) and a malicious actor could add multiple users to the mapping.

Tools Used

Manual, foundry

Recommendations

Add the onlySanta protection as expected