First Flight #5: Santa's List

Summary

The collectPresent function in the smart contract is designed to reward users based on their status (NICE or EXTRA NICE) with NFTs and SantaTokens. However, a critical vulnerability exists in this function, allowing users to collect an unlimited number of tokens.

Vulnerability Details

The vulnerability in the collectPresent function stems from the lack of checks to prevent users from collecting more than once. Although the function attempts to restrict users from collecting multiple times by checking their balance (balanceOf(msg.sender) > 0), this method is flawed. A user can bypass this restriction by simply transferring their existing token to another address, thereby resetting their balance to zero. This allows them to collect additional NFTs and SantaTokens indefinitely, as long as they continue transferring each newly acquired token to another address.

Impact

This vulnerability poses a severe threat as it allows for the unlimited minting of NFTs and SantaTokens. Since there is no supply control for either, a user with the EXTRA NICE status can potentially mint infinite amounts of both, leading to hyperinflation of the tokens and devaluation. The integrity of the token distribution system is compromised, undermining the credibility of the entire system.

Tools Used

Manual Code Review

Recommendations

• Implement a more robust mechanism to track whether a user has already collected their present. This could involve maintaining a mapping of addresses to boolean values, marking whether they have already collected their reward.

• Adittional note: Consider adding a supply cap for both NFTs and SantaTokens to prevent hyperinflation and maintain their value.