checkList() is public
Summary
In the comments of checkList() it says that this method should only be callable by Santa but there is no such check and is callable by anyone
Vulnerability Details
Method's comments and implementation mismatch. the method CheckList() should only be callable by Santa. the onlySanta() modifier is missing. anyone can call it and update his status in the s_theListCheckedOnce mapping.
Impact
Impact is quite low as to be able to receive a present via the collectPresent() method you need to be NICE or EXTRANICE in both the s_theListCheckedOnce and s_theListCheckedTwice mappings. and the function that modifies s_theListCheckedTwice (checkTwice() ) is secure.
Tools Used
Recommendations
add onlySanta() modifier
Lead Judging Commences
Access Control on checkList()
Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.