First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Everyone Can Collect "Nice" Present If Unchecked

teddy

Summary

Anyone is able to collect the "Nice" present if Santa has not checked their status to something other than Nice.

Vulnerability Details

The default value for enums in Solidity is the first value. With current order of the enum Status, all address in the s_theListCheckedOnce and s_theListCheckedTwice mappings have the default value of Nice enabling all addresses that have not been checked to a different status to later collect a present.

// Current implementation
enum Status {
NICE,
EXTRA_NICE,
NAUGHTY,
NOT_CHECKED_TWICE
}
​
mapping(address person => Status naughtyOrNice) private s_theListCheckedOnce;
mapping(address person => Status naughtyOrNice) private s_theListCheckedTwice;

POC

function testCollectPresentNiceWithoutChecks() public {
vm.startPrank(santa);
assertEq(
uint256(santasList.getNaughtyOrNiceOnce(user)),
uint256(SantasList.Status.NICE)
);
assertEq(
uint256(santasList.getNaughtyOrNiceTwice(user)),
uint256(SantasList.Status.NICE)
);
vm.stopPrank();
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
santasList.collectPresent();
assertEq(santasList.balanceOf(user), 1);
vm.stopPrank();
}

Impact

All addresses that have not been checked to a status other than Nice can collect a present after CHRISTMAS_2023_BLOCK_TIME.

Tools Used

Manual review.

Recommendations

Change to order of the enum's values so that the first value is a sensible default.

// Sensible default for the first value.
enum Status {
NOT_CHECKED,
NICE,
EXTRA_NICE,
NAUGHTY,
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

default status is nice

In Solidity the first element of an enum is the default value. In Santa's List, the means each person is mapped by default to 'NICE'.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.