First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

CheckList is callable by non-Santa

teddy

Summary

Any is able to call checkList function and set the status of any address.

Vulnerability Details

Anyone is able to call checkList function and set the status of any address. This may influence the status Santa sets in checkTwice if Santa is referencing the first list.

POC

function testNoSantaCheckList() public {
vm.prank(user);
// checkList should revert but does not due to the lack of the onlySanta guard
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
assertEq(uint256(santasList.getNaughtyOrNiceOnce(user)), uint256(SantasList.Status.EXTRA_NICE));
}

Impact

The status of an address may not be what Santa expects because anyone can update any addresses's status.

Tools Used

Manual review.

Recommendations

Add the existing onlySanta modifier to the checkList function.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.