First Flight #5: Santa's List

Summary

As per protocol's documentation, SantasList::buyPresent is intended to trade2e18 of SantaToken for an NFT present.
But in the protocol's code, the function costs only 1e18 of SantaToken to buy an NFT. This would result in a loss of revenue for the protocol as well as confusion among the users.

Vulnerability Details

In the documentation of the protocol under the Collecting Presents section, the SantasList::buyPresent function is intended to cost 2e18 of SantaToken for an NFT :

And while that intended cost is declared at line 88 in SantasList.sol, it's never actually used in the concerned function :

The vulnerable SantasList::buyPresent function which doesn't make use of the PURCHASED_PRESENT_COST constant :

Furthermore, the SantaToken::burn function isn't even programmed to accept any parameter for the NFT cost; instead a cost of 1e18 of SantaToken is hardcoded in it to execute the function :

All of this results in SantasList::buyPresent only costing 1e18 of SantaToken instead of 2e18 to buy an NFT present.

Impact

This vulnerability has following financial and functional consequences :

• Due to the bug, users are able to acquire NFTs at half the intended cost, resulting in a direct financial loss for the protocol.

• The bug creates a misalignment between the intended protocol design and the actual implementation. This inconsistency can lead to confusion among users.

• The discrepancy between the stated cost and the actual cost can erode user trust in the protocol.

Tools Used

Manual review.

Recommendations

Make appropriate changes in both SantaToken::burn and SantasList::buyPresent functions to accept PURCHASED_PRESENT_COST constant as the NFT cost.
Note: I'm not providing exact code modifications here because of another vulnerability impacting these functions which would require further modifications to the code.