First Flight #5: Santa's List

Summary

Santa token can be burnt from other user with present minted to attacker

Vulnerability Details

Arbitrary Santa token holder address can be passed as presentReceiver. Token will be burnt from the arbitrary holder and present is mined to the attacker

Impact

Attacker receives nft presents by burning Santa token from holders

Tools Used

Recommendations

Burn token only from msg.sender, i_santaToken.burn(msg.sender);