First Flight #5: Santa's List

Summary

The collectPresent function in the SantasList.sol allows Santa to give himself a gift. According to the documentation, only users can call this function to have a gift.

Vulnerability Details

The vulnerable code can be found in the collectPresent function. The function checks if the current timestamp is before the Christmas 2023 block time and if the caller has not already collected a gift. However, it does not enforce any additional restrictions on Santa, allowing Santa to give himself a gift.

PoC

Impact

This vulnerability allows Santa to abuse the system and obtain one gift. Which is not wanted according to the documentation.
Moreover, because of an other vulnerability ("Inadequate Verification of Distributed Presents"), Santa can steal all the gifts.

Without exploiting other vulnerabilities, this one is only Medium because it should only permit Santa (one person) to have one gift by himself (very moderate loss for the protocol).

Tools Used

Manual review

Recommendations

To fix this vulnerability, additional checks should be implemented in the collectPresent function to ensure that Santa is not able to give himself a gift. This can include verifying the sender's address and don’t accept Santa’s address. One solution is to add this modifier to collectPresent():