First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect Present Cost

teddy

Summary

The implementation's token cost to buyPresent() is 1e18 but should be 2e18 according to the documentations and indicated by the value of the PURCHASED_PRESENT_COST variable.

Vulnerability Details

If the expectation is that each "Extra Nice" user can buy one present for a user then the smart contract is behaving as expected. The issue is that the documentation and the unused variable PURCHASED_PRESENT_COST is incorrect. The amount of token that should be minted has not been documented.

POC

function testBuyPresent() public {
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
santaToken.approve(address(santasList), 1e18);
​
santasList.collectPresent();
​
// 1. Token balance is 1e18. Expected amount to mint is not documented.
assertEq(santaToken.balanceOf(user), 1e18);
// 2. buyPresent burns 1e18. But PURCHASED_PRESENT_COST and documents note cost should be 2e18.
santasList.buyPresent(user);
assertEq(santasList.balanceOf(user), 2);
// 3. 1e18 were burnt as the cost.
assertEq(santaToken.balanceOf(user), 0);
vm.stopPrank();
}

Impact

Depends on expected behaviour.

Tools Used

Manual review.

Recommendations

If the expectation is that each "Extra Nice" user can buy one present then update the mint and burn amounts to 2e18 in the SantaToken contract. These amounts could also be refactor into contract arguments rather than being hard keyed to increase the resusability of this contract. Alternative the documentation and PURCHASED_PRESENT_COST could be update to reflect the actual amounts of 1e18.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Price is not enforced in buyPresent

This line indicates that the intended cost of presents for naughty people should be 2e18: https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L87 PURCHASE_PRESENT_COST should be implemented to enforce the cost of presents.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.