First Flight #5: Santa's List

Summary

The buyPresent function burns a SantaToken from the presentReceiver address, not the caller

Vulnerability Details

Lines 172-174
The buyPresent function burns SantaToken from the presentReceiver's balance rather than the caller's balance. This is a significant security flaw as it allows anyone to burn tokens from another user's balance without permission.
While the contract does not directly handle ETH or other native blockchain funds, it interacts with an ERC20 token (SantaToken).

Impact

The buyPresent function calls an external contract (i_santaToken.burn) which could potentially be a reentrancy vector if the SantaToken contract is not implemented securely.

Tools Used

Audit Wizard/Slither (VS Code)

Recommendations

Modify the burn function to ensure it is not susceptible to reentrancy.