Anyone Can Call The checkList() Function
Summary
Anyone can call the checkList function in https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L121C13-L121C14,
Vulnerability Details
In the documentation, it was stated that only the Santa can call some specific functions (including checkList()) function due to their critical relevant to the logic of the code, unfortunately, there was no access control in place, thus allowing anyone to call on the function and perform critical actions.
Impact
Anyone can assign the NICE && EXTRA_NICE to their liking and can mint NFTs in that case
Tools Used
Manual Analysis
Recommendations
There is a modifier in place (onlySanta) but was not added to the function, adding that will allow only santa to call on the function
Lead Judging Commences
Access Control on checkList()
Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.