Submission Details
Severity:
function checkList is missing onlySanta modifier
Summary
Everyone can call 'checkList' function
Vulnerability Details
Function is missing :
modifier onlySanta() {
if (msg.sender != i_santa) {
revert SantasList__NotSanta();
}
_;
}
This means anyone can set s_theListCheckedOnce and cause different issues setting the status to however he sees fit.
function checkList(address person, Status status) external {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Impact
Anyone can set his 's_theListCheckedOnce'
Tools Used
Manual review
Recommendations
Add the onlySanta modifier.
Updates
Lead Judging Commences
inallhonesty almost 2 years ago
Submission Judgement Published Assigned finding tags:
Access Control on checkList()
Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.