First Flight #5: Santa's List

Summary

Risk of Duplicate Present Collection

Vulnerability Details

The current implementation checks balanceOf(msg.sender) > 0 to determine eligibility for present collection. However, this check does not prevent duplicate collections. For instance, if a user receives a present and then transfers it to another account, their balance returns to zero. This reset allows them to potentially collect presents repeatedly.

Impact

This loophole in the balance check allows for the theoretical possibility of infinite present collection, as users could continually receive and transfer presents to exploit the system.

Tools Used

Recommendations

Implement a new mapping to track the collection status of each account individually. This would prevent the possibility of duplicate collections by maintaining a record of whether an account has already collected a present.