First Flight #5: Santa's List

Summary

The function SantasListTest::collectPresent() can be call more than once by a address.
Therefore, before executing the collectPresent() function, a check must be made on
each address to ensure that it has never had to collect NFTs or SantaTokens before

Vulnerability Details

If an address only needs to collect NFTS and SantaTokens once, we need to ensure that
the address calling the collectPresent() function has never collected before, as it
may have collected and transferred them to another account so that its account is empty
in order to pass the condition requiring it.
On the other hand, addresses that already have one or more NFTS in their account can not
collect because the revert condition requires their account balance to be equal to zero.

Here the check that needs to be made is to ensure before each collection that the address
making the request has never made a collection before this request.
To do this, we can use the NFT snapshot extension.

Impact

Nice or Extra Nice user can collect present many times.
And users who already have NFTS in their account but who do not necessarily 
come from `SantasList` contract can never collect present.

Tools Used

-Foundry

Recommendations

use the plugin NFT snapshot in the collectPresent function,
instead of just checking that the account has no NFT.