First Flight #5: Santa's List

Summary

The vulnerability lies in the SantasList.buyPresent function, where an attacker can wrongfully burn tokens from the presentReceiver and mint additional presents. This manipulation leads to an unauthorized transfer of presents, impacting user balances and compromising the integrity of the contract's present purchase mechanism

Vulnerability Details

In the vulnerable buyPresent function, an attacker can exploit it by leveraging an extra nice user's address who has tokens to initiate the purchase of a present through the buyPresent function. This results in the burning of tokens from the unsuspecting user, followed by the unauthorized minting of additional presents. As a consequence, the attacker gains control over the present purchase mechanism, leading to a misalignment of user balances and compromising the intended functionality of the contract.

Impact

The identified vulnerability poses a significant impact on the smart contract's functionality and security. By exploiting the flaw in the buyPresent function, an attacker can wrongfully burn tokens from the intended recipient (presentReceiver) and initiate the unauthorized minting of additional presents.

POC

In the test file add this to the state variable :
address reciever = makeAddr("reciever");
Then add this function to test the exploit:

run this command to test only this function and observe the exploit
forge t --mt testAttackBuyPresent -vvvvv

Tools Used

Foundry & Manual Review

Recommendations

In the implementation of the i_santaToken burn function the presentReciever could be changed to msg.sender so the burn function burns tokens from whoever calls the function