First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

According to the documentation of SantaList, The `presentReceiver` is `NAUGHTY` in the `buyPresent` function. but, Check is missing in the `buyPresent` function.

naman1729

Summary

  • According to the documentation of SantaList, The presentReceiver is NAUGHTY in the buyPresent function. but, Check is missing in the buyPresent function.

Vulnerability Details

  • Check is missing in the buyPresent function to check the presentReceiver is NAUGHTY

function buyPresent(address presentReceiver) external {
@> i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}

  • Reference from the documentation of SantaList

Once they are checked twice, NICE users can collect their NFT, and EXTRA_NICE users can collect their NFT and they are given SantaTokens.
@> The SantaToken is an ERC20 that can be used to buy the NFT for their NAUGHTY or UNKNOWN friends.
​

Impact

  • Anyone can buy the NFT for NICE or Extra NICE users which create confilict with the documentation of SantaList

Tools Used

  • Manual Review

Recommendations

  • By Adding the check in the buyPresent function, we can avoid the prsentReceiver as NICE or Extra NICE and can avoid the conflict with the documentation of SantaList

+ error SantasList__NotNAUGHTY();
​
function buyPresent(address presentReceiver) external {
+ if (s_theListCheckedTwice[presentReceiver] != Status.NAUGHTY) {
+ revert SantasList__NotNAUGHTY();
+ }
​
i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.