First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Non santa can do first pass for anyone

0xfuluz

Summary

User not santa can call checklist() for any adress to set first pass.

Vulnerability Details

Function checkList() not verify user so anyone can call and set status in s_theListCheckedOnce for any address.

Test POC:

function testNonSantaCanCheckList() public {
vm.assume(user != santa);
vm.prank(user);
santasList.checkList(user2, SantasList.Status.NICE);
assertEq(
uint256(santasList.getNaughtyOrNiceOnce(user2)),
uint256(SantasList.Status.NICE)
);
}

Impact

If set status in s_theListCheckedTwice will set base on s_theListCheckedOnce, attacker change status in checkedOnce to eligible for a present.
If status s_theListCheckedTwice of user have updated, attacker can update status in s_theListCheckedOnce to make user can't collect Present

Tools Used

Manual Review & Foundry

Recommendations

Add modifier onlySanta to make sure only function only callable by santa

Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.