First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

checkList function does not have the onlySanta modifier

shawnsmlee

Summary

Anyone can call the checkList function, regardless of whether they are Santa (i.e. the contract deployer) or not.

Vulnerability Details

The onlySanta modifier used to verify that the caller of a function is the contract deployer has not been applied to the checkList function in the SantasList contract.

Impact

Anyone can set the Status of any other address.

Example:

function testCheckListIfNotSanta() public {
vm.prank(makeAddr("bad_actor"));
​
// Should revert, but doesn't.
santasList.checkList(user, SantasList.Status.NAUGHTY);
​
// Bad actor successfully sets the status of another user on Santa's List.
assertEq(uint256(santasList.getNaughtyOrNiceOnce(user)), uint256(SantasList.Status.NAUGHTY));
}

Tools Used

  • Foundry

Recommendations

  • Add the onlySanta modifier to the checkList function.

  • Add a test to verify that the function can only be called by the contract deployer, like so:

function testCantCheckListIfNotSanta() public {
vm.prank(makeAddr("bad_actor"));
vm.expectRevert();
santasList.checkList(user, SantasList.Status.NAUGHTY);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.