First Flight #5: Santa's List

Summary

Limitation in Receiving Presents via the buyPresent Function

Vulnerability Details

The buyPresent function's current implementation relies on _mintAndIncrement(), which in turn exclusively calls _safeMint(msg.sender, s_tokenCounter++). Consequently, this process only mints presents for the sender (the one invoking buyPresent), rather than an intended recipient.

Impact

This implementation restricts the functionality, as it prevents users from purchasing presents for other accounts.

Tools Used

Foundry

Recommendations

Introduce a new receiver parameter in the buyPresent function. Modify _mintAndIncrement function to accept this receiver parameter, enabling the minting for the intended recipients, rather than just the msg.sender.