Missing onlySanta modifier
Summary
Anyone can set an address to be included in in the list to be considered for receiving the NFT gift.
Vulnerability Details
In the absence of the onlySanta modifier, Anyone can maliciously call the checkList function and set a user's address to be eligible for the NFT gift. There should be an onlySanta modifier attached to this function to guard against this.
Impact
The NFT gift will become open to undeserving users. Also, malicious users can deliberately call this function and alter the state of other users.
Tools Used
Manual
Recommendations
The onlySanta modifier should be appended to the checkList function. This ensures that only Santa can use this function to add deserving users to his list.
Lead Judging Commences
Access Control on checkList()
Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.