Submission Details
Severity:
Approve not required in buyPresent
Summary
For some reason, the documentation states that users must first approve tokens to SantasList, but this is not necessary as it internally uses the burn function, causing confusion about whether the desired result is actually achieved.
Vulnerability Details
There are various issues in this function, but it seemed appropriate to address this inconsistency in a separate issue.
Impact
Possible unexpected results.
POC
function testBuyPresentWithoutApprove() external {
vm.startPrank(address(santasList));
santaToken.mint(user);
vm.stopPrank();
vm.startPrank(user);
santasList.buyPresent(user);
vm.stopPrank();
}
Tools Used
Foundry
Recommendations
Review the implementation to clarify any confusion. Ensure that the documentation accurately reflects the behavior of the buyPresent function and consider updating it accordingly.
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.