First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing access control check in `SantasList::checkList()` allows the attacker to prevent the users from claiming rewards

sobieski

Summary

In the contradiction to the documentation and comments, which state that only Santa can check the list once, anyone is able to call the SantasList::checkList() method due to the missing access control check.

Vulnerability Details

The SantasList::checkList() looks as follows:

/*
* @notice Do a first pass on someone if they are naughty or nice.
* Only callable by santa
*
* @param person The person to check
* @param status The status of the person
*/
function checkList(address person, Status status) external {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}

The onlySanta modifier is missing from the function. Therefore anyone will be able to call it.

The impact of this vulnerability is quire severe, as the attacker can block anyone from claiming their rewards. In order to claim the rewards, one has to be checked twice and receive the NICE or EXTRA_NICE status. The attacker can simply override the contents of s_theListCheckedOnce for a particular address, changing their status to NAUGHTY or NOT_CHECKED_TWICE, effectively blocking them from claiming any rewards.

Impact

Users can be blocked from claiming rewards.

Tools Used

Manual review

Recommendations

Add the onlySanta modifier to the SantasList::checkList() :

-function checkList(address person, Status status) external {
+ function checkList(address person, Status status) external onlySanta {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.