Wrong handling of default value
Summary
The default value of SantasList::Status allows not yet checked users to collect a present.
Vulnerability Details
Anyone can bypass status checks since everyone has as the status by default the first value of SantasList::Status, which is NICE. Hence, everybody can collect present.
Impact
Anyone who has not yet been checked can get at least SantasList ERC721 token as a present.
Tools Used
Manual review
Recommendations
Add in SantasList::Status a new value NOT_CHECKED_ONCE as the first member of the enum.
Lead Judging Commences
default status is nice
In Solidity the first element of an enum is the default value. In Santa's List, the means each person is mapped by default to 'NICE'.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.