First Flight #5: Santa's List

Summary

The checkList function in the smart contract allows anyone to modify the status of a person on Santa's list, regardless of their role or permission. This can lead to unauthorized manipulation of the list, potentially blocking the collection of presents for everyone. The function should only be accessible to authorized parties, such as Santa, to maintain the integrity of the list.

Vulnerability Details

The vulnerability arises from the lack of access controls in the checkList function. Any user can call this function and modify the status of a person on Santa's list, regardless of their role or permission. This means that an attacker can set themselves as "Nice" or set others as "Naughty", blocking the collection of presents for everyone.

Foundry PoC

Impact

By exploiting this vulnerability, any person (especially naughty people) can disrupt the process of collecting presents by manipulating the status of many users in s_theListCheckedOnce, which will break both equalities below (line 154 to 160 in collectPresent), so it will be impossible to collect presents :
if (s_theListCheckedOnce[msg.sender] == Status.NICE && s_theListCheckedTwice[msg.sender] == Status.NICE)
if ( s_theListCheckedOnce[msg.sender] == Status.EXTRA_NICE && s_theListCheckedTwice[msg.sender] == Status.EXTRA_NICE)

This can potentially ruin the holiday spirit for many individuals.

Tools Used

Manual review

Recommendations

To mitigate this vulnerability, it is recommended to implement access controls in the checkList function. This can be achieved by adding a modifier, such as onlySanta, to restrict the function's access to authorized parties only (Santa here).